Install AWS CLI and Configure Credentials

You've written Python that runs locally, but the moment you need to deploy it to AWS, you hit a wall: the AWS Management Console is slow, click-heavy, and impossible to automate. The pain is real — manually creating S3 buckets, uploading files, and managing IAM roles through a browser is a recipe for mistakes and wasted hours. The cure is the AWS Command Line Interface (CLI): a single, powerful tool that brings the entire AWS platform to your terminal, ready to be scripted with Python and integrated into DevOps pipelines. In this lesson, you'll learn to install AWS CLI and configure credentials safely, unlocking the ability to manage AWS services with precision and speed.

The Problem This Lesson Solves

Imagine you need to create an S3 bucket, upload a file, and set a lifecycle policy — three simple tasks that require dozens of clicks in the AWS console. Now imagine doing that for fifty buckets across three environments. The console doesn't scale. Worse, sharing access keys via email or hardcoding them in code is a security nightmare that can bankrupt your company if leaked.

The AWS CLI solves both problems: it gives you a fast, scriptable interface to all AWS services, and it provides a secure, centralized way to store and manage credentials. By the end of this lesson, you'll be able to run aws s3 ls from your terminal and see your buckets a few seconds later, all without touching a browser. This is the foundation for every subsequent lesson in this track — from using Boto3 in Python to deploying infrastructure with Terraform.

Core Concept / Mental Model

Think of the AWS CLI as a remote control for your AWS account. Just as a remote control sends signals to your TV to change channels or volume, the AWS CLI sends HTTPS requests to AWS's API endpoints to create, modify, and delete resources. The CLI itself is a Python-based tool (it runs on Python, though you don't need to write Python to use it) that wraps the AWS SDK and provides a clean command-line interface.

Credentials are the power source for that remote control. Without them, the CLI can't authenticate your requests, and AWS will reject them with a 403 Forbidden error. Credentials consist of two pieces: an Access Key ID (like a username) and a Secret Access Key (like a password). You create these in the AWS Identity and Access Management (IAM) service, and they grant your CLI the exact permissions you assign to the IAM user.

The AWS CLI stores these credentials in a credentials file (~/.aws/credentials) and a config file (~/.aws/config). This separation is intentional: the credentials file holds sensitive keys, while the config file holds non-sensitive defaults like region and output format. You can also set environment variables or use IAM roles on EC2 instances — we'll compare these methods later in this lesson.

How It Works Step by Step

Step-by-step, the flow looks like this:

1. Install Python (if not already installed) — the AWS CLI requires Python 3.8 or later.
2. Install the AWS CLI using pip, the Python package manager.
3. Create an IAM user in the AWS Console with programmatic access.
4. Attach a policy (e.g., AdministratorAccess for learning, or least-privilege policies for production).
5. Generate and download the Access Key ID and Secret Access Key (only shown once!).
6. Run aws configure and provide the key, secret, default region, and output format.
7. Verify authentication with aws sts get-caller-identity.

Each step is purposeful: the installation gives you the tool, the IAM setup gives you secure credentials, and aws configure stores them for you. The cause-and-effect here is direct — if you skip IAM, you get InvalidClientTokenId; if you misconfigure the region, you get AccessDenied errors for region-specific calls.

Hands-on Walkthrough

Let's get our hands dirty. First, install the AWS CLI. Assuming you have Python 3.8+ and pip, run:

# Install the AWS CLI version 2 via pip
pip3 install awscli --upgrade --user

# Verify the installation
aws --version

Expected output:

aws-cli/2.15.1 Python/3.11.6 Linux/5.15.0-91-generic botocore/2.15.1

If pip3 isn't found, install Python from python.org or use your package manager (e.g., apt install python3-pip on Ubuntu). Now, create an IAM user and capture your credentials. In the AWS Console, go to IAM → Users → Create User, check "Programmatic access," attach the AdministratorAccess policy (or a custom one for learning), and download the CSV or note the keys.

Then configure the CLI:

aws configure

You'll be prompted interactively. Enter:

AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-east-1
Default output format [None]: json

Now verify everything works:

aws sts get-caller-identity

Expected output (truncated):

{
    "UserId": "AIDAEXAMPLE1234567890",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/devops-learner"
}

That output confirms your credentials are valid and you've authenticated as the devops-learner user. You're now ready to manage AWS from the command line!

For a more automated, non-interactive setup — useful in CI/CD or scripting — you can use environment variables:

export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
export AWS_DEFAULT_REGION="us-east-1"

These variables override the credentials file, which is handy for testing but remember to clear them afterward to avoid leaking secrets in your shell history.

Compare Options / When to Choose What

There are several ways to store AWS credentials. Here's a comparison:

For this learning path, start with aws configure. As you move to production deployments, adopt IAM roles on EC2 to eliminate long-lived keys entirely.

Troubleshooting & Edge Cases

Error: aws: command not found — The CLI isn't in your PATH. If you used pip3 install --user, add ~/.local/bin to PATH (e.g., export PATH=$HOME/.local/bin:$PATH in ~/.bashrc).

Error: InvalidClientTokenId — The Access Key ID is wrong or doesn't exist. Redownload and re-run aws configure.

Error: SignatureDoesNotMatch — The Secret Access Key is incorrect. Don't mix up characters (e.g., O and 0, l and 1). Delete the credentials file and reconfigure.

Error: AccessDenied when calling a specific service — Your IAM user lacks permission. Attach the relevant policy (e.g., AmazonS3FullAccess) via IAM console.

Edge case: Multiple AWS accounts — Use named profiles:

aws configure --profile prod
# Then use:
aws s3 ls --profile prod

This avoids clobbering your default credentials.

Edge case: Region-specific services — Some services (like S3) are global, but most (like EC2) are regional. Setting the correct region in aws configure avoids confusing errors. Check your region in the console URL (e.g., us-west-2.console.aws.amazon.com).

What You Learned & What's Next

You've mastered the essential skill of installing AWS CLI and configuring credentials. You can now: understand why this tool is critical for DevOps automation, install it via pip, create and secure IAM credentials, and verify authentication. You also learned the mental model of the CLI as a remote control and credentials as the power source, plus the key options (config file, environment variables, IAM roles) and their trade-offs. This is the foundation for every AWS operation you'll perform in Python.

Next, we'll dive into working with AWS services using Python and Boto3 — where you'll programmatically interact with S3, EC2, and more. The CLI you just installed uses the same SDK under the hood, so everything you learned here will transfer directly. Get ready to automate AWS like a pro!