AWS Developer Tooling, AWS CLI Configuration, and CloudShell | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

This lesson covers the basic tooling needed to perform AWS hands-on work from a local workstation and from the AWS Management Console. The focus is on installing Visual Studio Code, installing the AWS Command Line Interface, configuring CLI credentials, testing access with Amazon S3 commands, and understanding why AWS CloudShell is often safer and easier than storing long-term credentials locally.

For the SAP-C02 exam, this is not a deep architecture topic by itself, but it supports several important exam areas: secure access to AWS, credential handling, operational tooling, automation, and choosing the right method for administering AWS resources.

Key Concepts

Visual Studio Code for AWS Study and Hands-On Labs

Visual Studio Code is used as a lightweight editor for working with AWS-related files such as:

JSON policy documents
IAM policies
CloudFormation or infrastructure templates
Code snippets
CLI command examples
Configuration files

From a solutions architect perspective, VS Code is not an AWS service, but it is a practical tool for reviewing and editing configuration artifacts. In real environments, architects often review IAM policies, deployment templates, and automation scripts before approving or deploying changes.

For exam preparation, the key point is simple: many AWS tasks are not performed only through the console. You should be comfortable reading structured configuration files and understanding how those files translate into AWS behavior.

AWS Command Line Interface

The AWS CLI is a local command-line tool that allows you to interact with AWS services using commands instead of the AWS Management Console.

Once installed and configured, the AWS CLI can be used to manage services such as:

Amazon S3
IAM
EC2
VPC
CloudFormation
CloudWatch
Lambda
Many other AWS services

The CLI command syntax is generally the same across Windows, macOS, and Linux. The difference is usually the local shell environment and file system navigation commands, not the AWS CLI command structure itself.

For example, an AWS command such as the following works the same conceptually across operating systems:

aws s3 ls

However, navigating to a local folder, creating directories, or editing local files will vary depending on whether you are using Command Prompt, PowerShell, Bash, or another shell.

Installing the AWS CLI

The AWS CLI is installed locally on your workstation.

On Windows, the installer is typically an MSI package. After installation, you can verify the installation by opening a command prompt and running:

aws --version

If the AWS CLI is installed correctly, this returns the installed AWS CLI version.

This only confirms that the CLI is installed. It does not confirm that the CLI has permissions to access AWS.

CLI Credentials and Authentication

After installing the AWS CLI, AWS commands will fail until credentials are configured.

For example, attempting to list S3 buckets before credentials are configured may return an error similar to:

Unable to locate credentials

This means the CLI is installed, but it does not yet know which AWS identity to use.

The basic configuration command is:

aws configure

This prompts for:

AWS Access Key ID
AWS Secret Access Key
Default Region
Default output format

The access key ID and secret access key function similarly to a username and password for programmatic access.

Important Security Concern: Access Keys Are Sensitive

Access keys are long-term credentials. They must be protected carefully.

The secret access key is only shown once when created. If it is lost, it cannot be retrieved again. A new access key must be created.

A major security concern is that locally configured CLI credentials are stored on the workstation. Depending on the setup, they may be stored in plain text credential files. This creates risk if the workstation is compromised, if credentials are copied accidentally, or if they are committed into source control.

For the SAP-C02 exam, remember that long-term access keys are generally not the preferred security design when better options are available.

Better options include:

IAM roles for AWS services
Instance profiles for EC2
AWS CloudShell
AWS IAM Identity Center
Temporary credentials
Federated access

Default AWS Region

When configuring the AWS CLI, you choose a default Region.

Example:

us-east-1

The default Region matters because many AWS services are regional. If you create or query resources without specifying a Region, the CLI uses the configured default.

This can cause confusion in real environments. A command may appear to return no resources simply because the CLI is pointed at the wrong Region.

For exam scenarios, always pay attention to whether the service is regional or global.

Testing CLI Access with Amazon S3

A common way to test CLI access is to run:

aws s3 ls

This lists S3 buckets that the configured identity has permission to view.

If no buckets are returned, that does not always mean the command failed. It may simply mean there are no buckets in the account or the identity does not have permission to list them.

You can also test bucket creation with:

aws s3 mb s3://unique-bucket-name

S3 bucket names must be globally unique. This means the bucket name must be unique across all AWS accounts, not just your own account.

AWS CloudShell

AWS CloudShell is a browser-based shell available from the AWS Management Console.

CloudShell allows you to run AWS CLI commands without installing or configuring the CLI locally.

The major advantage is that CloudShell automatically uses credentials associated with your signed-in AWS user session. This avoids the need to create and store long-term access keys on your local workstation.

CloudShell is useful for:

Running quick AWS CLI commands
Testing commands during troubleshooting
Avoiding local credential storage
Working from managed or temporary workstations
Reducing setup time for labs

For the SAP-C02 exam, CloudShell is important because it reinforces a broader AWS security principle: prefer temporary or managed access patterns over static long-term credentials when possible.

Access Keys vs IAM Roles vs CloudShell

Access keys are easy to understand and quick to configure, but they are not the most secure long-term option.

IAM roles are preferred when AWS resources need to access other AWS services. For example, an EC2 instance that needs to read from S3 should usually use an IAM role through an instance profile instead of storing access keys on the instance.

CloudShell is useful for administrative CLI access because it avoids local credential setup and uses the permissions of the signed-in console identity.

Exam-Relevant Takeaways

For SAP-C02, the main thing to remember is not the exact installation process. The exam is more likely to test the security and operational implications of different access methods.

Long-term access keys are simple but riskier because they can be exposed, copied, or stored insecurely.

IAM roles are preferred for AWS services that need permissions to call other AWS services.

CloudShell is a good option for interactive AWS CLI work because it is browser-based and automatically uses the signed-in user’s AWS permissions.

The AWS CLI requires both installation and credential configuration before it can interact with AWS.

S3 bucket names must be globally unique.

The default Region configured in the AWS CLI affects where many commands are executed unless a Region is explicitly specified.

Architecture Decision Guide

Scenario	Best AWS Choice	Why
Need to edit IAM policy JSON or code snippets during labs	Visual Studio Code	Lightweight editor for structured files, policy documents, and command examples
Need to run AWS commands from a local workstation	AWS CLI	Provides command-line access to AWS services from Windows, macOS, or Linux
AWS CLI is installed but commands fail with credential errors	Run `aws configure` or use a better credential method	The CLI needs credentials before it can authenticate to AWS
Need quick CLI access without local setup	AWS CloudShell	Browser-based CLI environment with credentials automatically tied to the signed-in AWS session
EC2 instance needs to access S3	IAM role with instance profile	Avoids storing access keys on the instance and uses temporary credentials
Human user needs controlled AWS console and CLI access	IAM Identity Center or federated access	Better governance and sign-in experience than long-term IAM user access keys
Need to test whether CLI credentials are working	`aws s3 ls`	Simple command to verify authentication and S3 permissions
Need to create an S3 bucket from the CLI	`aws s3 mb s3://unique-bucket-name`	Creates a bucket, but the name must be globally unique

Common Exam Traps

A common trap is assuming that installing the AWS CLI automatically gives access to AWS. It does not. The CLI must be configured with credentials or run from an environment that already has credentials available.

Another trap is choosing long-term access keys when the better answer is an IAM role. For AWS workloads, roles are usually the preferred answer.

Be careful with answer choices that store access keys on EC2 instances. For SAP-C02, this is usually not the best design. Use IAM roles and temporary credentials instead.

Do not confuse local shell commands with AWS CLI commands. AWS CLI commands are consistent across operating systems, but local file navigation differs.

Do not assume an empty response from aws s3 ls always means failure. It may mean there are no buckets visible to that identity.

Do not forget that S3 bucket names are globally unique.

Be careful with Region-related troubleshooting. A resource may exist in AWS, but your CLI may be configured to a different default Region.

Real-World Engineer Notes

In real environments, long-term access keys should be treated like passwords. They should not be shared in tickets, stored in scripts, pasted into documentation, or committed to Git repositories.

For production administration, organizations should strongly prefer federated access, IAM Identity Center, short-lived credentials, and role-based access.

For EC2, Lambda, ECS tasks, and other AWS workloads, IAM roles are the cleaner design. They reduce secret management overhead and make credential rotation easier because AWS handles temporary credential issuance.

CloudShell is especially useful for troubleshooting because it removes local workstation variables. If a command works in CloudShell but not on a local machine, the issue may be related to local CLI configuration, local credentials, local profile selection, network restrictions, or Region settings.

When troubleshooting AWS CLI issues, check:

Whether the CLI is installed
Whether credentials are configured
Which AWS profile is being used
Which Region is configured
Whether the IAM identity has permission
Whether the service is regional or global
Whether the command syntax is correct

For governance, access key creation should be monitored. Many organizations restrict IAM users from creating access keys unless there is a specific approved use case.

Quick Reference Summary

Visual Studio Code is useful for editing AWS policy documents, code snippets, and configuration files.

The AWS CLI allows you to manage AWS services from the command line.

Running aws --version verifies that the CLI is installed.

Running AWS commands before configuring credentials results in a credential error.

aws configure stores an access key, secret access key, default Region, and output format.

Long-term access keys are sensitive and should be avoided when better options exist.

IAM roles are preferred for AWS workloads.

CloudShell provides browser-based AWS CLI access using the signed-in user’s permissions.

aws s3 ls is a simple command to test CLI access.

S3 bucket names must be globally unique.

The default CLI Region matters for regional AWS services.

Flashcards

Q: What does the AWS CLI allow you to do?
A: It allows you to interact with AWS services from a command-line environment instead of using only the AWS Management Console.

Q: What command verifies that the AWS CLI is installed?
A: aws --version

Q: Why might aws s3 ls fail immediately after installing the AWS CLI?
A: Because credentials have not been configured yet.

Q: What command is commonly used to configure local AWS CLI credentials?
A: aws configure

Q: What information does aws configure request?
A: Access key ID, secret access key, default Region, and default output format.

Q: Why are long-term access keys risky?
A: They can be exposed, copied, stored insecurely, or compromised if the local workstation is compromised.

Q: What is a better option than storing access keys on an EC2 instance?
A: Use an IAM role attached through an instance profile.

Q: What is AWS CloudShell?
A: A browser-based shell in the AWS Management Console that allows you to run AWS CLI commands using the signed-in user’s credentials.

Q: Why is CloudShell often more secure than configuring local access keys?
A: It avoids storing long-term credentials on the local workstation.

Q: What does aws s3 ls do?
A: It lists S3 buckets visible to the configured AWS identity.

Q: What does aws s3 mb s3://bucket-name do?
A: It creates a new S3 bucket with the specified name.

Q: What is special about S3 bucket names?
A: They must be globally unique across AWS.

Q: Why does the AWS CLI default Region matter?
A: Many AWS services are regional, so commands may run against the configured Region unless another Region is specified.

Q: Are AWS CLI commands different on Windows, macOS, and Linux?
A: The AWS CLI commands are generally the same, but local file system navigation commands differ by operating system.

Q: For SAP-C02, which is usually preferred for AWS service-to-service access: access keys or IAM roles?
A: IAM roles.

Practice Questions

Question 1:
A company has an application running on an EC2 instance that needs to read objects from an S3 bucket. A developer suggests storing an IAM user access key and secret access key on the instance so the application can authenticate. What is the best design?

A. Store the access key and secret access key in a local configuration file on the EC2 instance
B. Store the access key and secret access key in the application source code
C. Attach an IAM role to the EC2 instance using an instance profile
D. Use the root account credentials on the EC2 instance

Correct Answer:
C. Attach an IAM role to the EC2 instance using an instance profile

Explanation:
IAM roles are the preferred method for granting AWS resources permissions to access other AWS services. This avoids storing long-term credentials on the instance.

Question 2:
A solutions architect installs the AWS CLI on a Windows workstation and runs aws s3 ls. The command returns an error indicating that credentials cannot be located. What is the most likely cause?

A. Amazon S3 is unavailable in the selected Region
B. The AWS CLI is installed but has not been configured with credentials
C. S3 bucket names must be globally unique
D. Visual Studio Code is not installed

Correct Answer:
B. The AWS CLI is installed but has not been configured with credentials

Explanation:
Installing the AWS CLI only installs the tool. The CLI still needs credentials before it can authenticate to AWS.

Question 3:
An engineer needs to run a few AWS CLI commands from the AWS Management Console but does not want to configure local access keys on a workstation. Which option is most appropriate?

A. AWS CloudShell
B. AWS Config
C. AWS CloudFormation
D. Amazon Inspector

Correct Answer:
A. AWS CloudShell

Explanation:
AWS CloudShell provides browser-based CLI access and automatically uses the permissions associated with the signed-in AWS user session.

Question 4:
A user runs a CLI command to create a new S3 bucket but receives an error that the bucket name is already taken. Why did this happen?

A. S3 bucket names must be unique within the VPC
B. S3 bucket names must be unique within the AWS account
C. S3 bucket names must be globally unique across AWS
D. S3 bucket names must match the IAM username

Correct Answer:
C. S3 bucket names must be globally unique across AWS

Explanation:
Amazon S3 bucket names are globally unique. Another AWS account may already be using the requested bucket name.

Question 5:
A team member says that AWS CLI commands are completely different on Windows and macOS. Which statement is most accurate?

A. AWS CLI commands are generally the same, but local file system navigation differs by operating system
B. AWS CLI commands only work on Linux
C. AWS CLI commands only work in CloudShell
D. AWS CLI commands require Visual Studio Code

Correct Answer:
A. AWS CLI commands are generally the same, but local file system navigation differs by operating system

Explanation:
The AWS CLI syntax is generally consistent across operating systems. The differences are mostly in the local shell and file system navigation commands.