AWS CLI and CloudShell Setup – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

This lesson prepares you to use AWS command-line tools throughout the course and in practical AWS administration. The primary tools are:

Visual Studio Code for viewing and editing code snippets, configuration files, and instructions.
AWS Command Line Interface (AWS CLI) for running AWS API operations from a local computer.
AWS CloudShell for running AWS CLI commands from a browser-based shell inside the AWS Management Console.

The goal is to verify that at least one command-line environment is available and that it can authenticate to AWS successfully.

Key Concepts

AWS CLI

The AWS CLI is a command-line tool for interacting with AWS services. It sends requests to AWS APIs using commands such as:

aws s3 ls

The AWS CLI is available for Linux, macOS, and Windows. The service commands are consistent across operating systems, although operating-system commands for navigating files, setting environment variables, and managing scripts may differ.

Installing the CLI does not automatically grant access to AWS. The CLI must use valid credentials or another supported authentication method before most AWS API calls will succeed.

AWS CloudShell

AWS CloudShell is a browser-based command-line environment launched from the AWS Management Console. It is useful when you want to run AWS CLI commands without installing or maintaining the CLI on your workstation.

CloudShell is associated with the identity used to access the console. In normal use, this means the shell can already use the permissions of the authenticated console identity, subject to AWS account, Region, and service restrictions.

Typical workflow:

Open the AWS Management Console.
Launch CloudShell from the console.
Wait for the shell environment to initialize.
Run an AWS CLI command, such as aws help or aws s3 ls.

CloudShell uses a Linux shell environment. Therefore, examples involving file paths or shell utilities may need adjustment when run locally on Windows.

Authentication and authorization

Authentication establishes who is making the request. Authorization determines what that identity is allowed to do.

A successful command such as aws s3 ls demonstrates that the environment was able to authenticate and that the identity did not receive an immediate authorization or service error for that operation. It does not mean the identity has unrestricted permissions across AWS.

For a local AWS CLI installation, credentials must be configured later using an appropriate AWS authentication method. Avoid embedding long-term access keys in source files or scripts. For human access, prefer federated access, IAM Identity Center, or other centrally managed identity mechanisms where available.

Visual Studio Code and course code

Visual Studio Code is a free editor that can be used to open course code, snippets, and instruction files. Course code may be downloaded from the repository associated with the final lesson in the section or synchronized with Git if you are comfortable using Git.

Exam-Relevant Takeaways

AWS CloudShell provides a command-line environment in the AWS Management Console, reducing the need for local installation.
CloudShell commands run using the permissions of the identity accessing the AWS console; it is not an independent privilege-escalation mechanism.
The AWS CLI requires authentication. Installing the executable alone is not sufficient.
AWS CLI service commands are generally the same in CloudShell and on a local workstation.
Operating-system commands, path syntax, shell behavior, and scripting conventions can differ between Linux, macOS, and Windows.
A successful CLI command confirms that the request was processed without an immediate error, but it does not prove broad access to all AWS services.
CloudShell availability can be restricted for some new AWS accounts. If it is unavailable, use a local CLI installation or contact AWS Support.

Architecture Decision Guide

Requirement	Recommended option	Reason
Run a quick AWS CLI command from a browser	AWS CloudShell	No local installation required and console identity is typically available to the shell
Automate AWS operations from a workstation or build environment	AWS CLI	Supports scripts and integration with local or CI/CD workflows
Edit snippets, scripts, and configuration files	Visual Studio Code	Provides a practical local editor for course and operational files
Use CLI commands when CloudShell is unavailable	Locally installed AWS CLI	Provides equivalent AWS service commands, subject to local authentication configuration
Grant access to CLI operations	IAM role, federated identity, IAM Identity Center, or another approved credential method	Separates identity and authorization from the tool itself

Common Exam Traps

Installing the AWS CLI is not authentication. A local installation still needs credentials or a role-based authentication mechanism.
CloudShell is not automatically an administrator shell. It inherits the permissions of the authenticated identity and remains subject to IAM policies and other controls.
CloudShell and local shells are not identical environments. AWS CLI syntax may be the same, but filesystem commands and path formats can differ.
An empty S3 listing is not necessarily an error. aws s3 ls may return no output when the identity has no visible buckets, while a permissions or authentication problem generally produces an error.
CloudShell is not guaranteed to be available in every account immediately. New accounts may encounter access restrictions.
The AWS CLI does not bypass Region or service constraints. Some commands require a Region, and resource visibility can depend on the selected Region and account.

Real-World Engineer Notes

Use CloudShell for short-lived administrative checks, especially from a trusted workstation where installing tools is inconvenient.
Use the local AWS CLI for repeatable scripts, development workflows, and integrations with source control or CI/CD systems.
Treat CloudShell as an operational environment: avoid leaving sensitive files, credentials, or production data there unnecessarily.
Prefer temporary credentials and role assumption over storing long-lived IAM access keys on a laptop.
Test authentication with a low-risk command before attempting mutating operations.
When troubleshooting, distinguish among three different problems: the tool is not installed, authentication failed, or authorization denied the requested action.
CloudShell session behavior, storage, and availability can vary by account and Region; do not use it as the sole location for durable artifacts.

Quick Reference Summary

Item	Summary
Visual Studio Code	Editor for code snippets, scripts, and instruction files
AWS CLI	Local command-line interface for calling AWS APIs
AWS CloudShell	Browser-based shell integrated with the AWS Management Console
Local CLI authentication	Must be configured using an approved credential or identity method
CloudShell authentication	Usually uses the permissions of the current console identity
Basic validation	`aws help` confirms the CLI responds; `aws s3 ls` tests an S3 API request
Portability	AWS CLI commands are similar across environments; shell and filesystem commands may differ

Flashcards

Q: What is AWS CloudShell?

A: A browser-based command-line environment available from the AWS Management Console.

Q: Does installing the AWS CLI authenticate a user?

A: No. The CLI still requires valid credentials or another supported authentication mechanism.

Q: Which identity normally supplies permissions to CloudShell?

A: The identity authenticated to the AWS Management Console.

Q: What does aws help do?

A: Displays AWS CLI help information and confirms that the CLI is responding.

Q: What does aws s3 ls attempt to do?

A: List S3 buckets visible to the authenticated identity.

Q: Does an empty result from aws s3 ls necessarily indicate failure?

A: No. It may simply mean that no visible buckets exist.

Q: What can differ between local Windows and CloudShell?

A: Filesystem navigation, path syntax, shell commands, and scripting behavior.

Q: What is the main advantage of CloudShell over a local CLI installation?

A: It provides a ready-to-use shell from the browser without requiring local tool installation.

Q: What should be used instead of hard-coded long-term access keys when possible?

A: Temporary, centrally managed identity mechanisms such as roles, federation, or IAM Identity Center.

Q: What should you do if CloudShell is unavailable for a new account?

A: Use the local AWS CLI or contact AWS Support about enabling access.

Practice Questions

Question 1

An architect needs to run a one-time S3 inventory command from a managed laptop. Installing software is prohibited, but the architect can access the AWS Management Console. Which option requires the least operational overhead?

A. Install the AWS CLI using a portable executable
B. Launch AWS CloudShell and run the command
C. Create an IAM user with administrator permissions
D. Upload the command to an S3 bucket and invoke it

Correct answer: B

Explanation: CloudShell provides a browser-based command-line environment and normally uses the permissions of the current console identity. Creating an administrator user is excessive and insecure, and the other options do not address the restriction on local installation.

Question 2

A developer installs the AWS CLI on a workstation and runs aws s3 ls. The command returns an error indicating that credentials are missing. What is the most likely cause?

A. The AWS CLI cannot access S3 from a workstation
B. Installing the CLI does not configure authentication
C. S3 can only be accessed through CloudShell
D. Visual Studio Code is not installed

Correct answer: B

Explanation: The CLI is only the client tool. It must be configured to use valid credentials or an approved role-based authentication method before it can call AWS APIs.

Question 3

An engineer runs aws s3 ls in CloudShell and receives no output and no error. Which conclusion is most appropriate?

A. CloudShell is not authenticated
B. The AWS CLI is not installed in CloudShell
C. The identity may be authenticated, but no visible S3 buckets exist
D. The account has automatically received administrator permissions

Correct answer: C

Explanation: A successful command with an empty result can indicate that there are no buckets visible to that identity. It does not prove administrator access or provide evidence that authentication failed.

Question 4

A script works in CloudShell but fails on a Windows workstation because it cannot find a file. The AWS API command itself is valid. What should the engineer investigate first?

A. Whether S3 is supported on Windows
B. Differences in shell commands and filesystem path syntax
C. Whether CloudShell uses a different AWS API
D. Whether Visual Studio Code changes AWS permissions

Correct answer: B

Explanation: AWS CLI service commands are generally portable, but shell commands, path formats, and scripting conventions vary between Linux-based CloudShell and Windows.

Question 5

A newly created AWS account cannot launch CloudShell, while a local AWS CLI installation is available. What is the most practical immediate response?

A. Grant the local CLI administrator permissions automatically
B. Use the local CLI with approved authentication and contact AWS Support about CloudShell access
C. Reinstall Visual Studio Code
D. Delete and recreate all IAM identities

Correct answer: B

Explanation: Some new accounts may face CloudShell access restrictions. The local CLI can be used as an alternative, provided it is authenticated securely and authorized for the required operations. AWS Support can investigate the CloudShell restriction.