Modules · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Who am I, what can I do?
aws sts get-caller-identity | Account and ARN of the current credentials |
aws sts assume-role --role-arn <arn> --role-session-name asha | Get temporary credentials for a role |
aws iam simulate-principal-policy --policy-source-arn <arn> --action-names s3:GetObject --resource-arns <arn> | Would this be allowed? |
aws iam list-attached-role-policies --role-name <role> | Managed policies on a role |
Evaluation in one line
explicit Deny > explicit Allow > implicit deny | Any matching Deny wins; otherwise you need an Allow |
Inspect
aws ec2 describe-vpcs --query 'Vpcs[].[VpcId,CidrBlock]' --output table | VPCs and their CIDRs |
aws ec2 describe-subnets --filters Name=vpc-id,Values=<vpc> --query 'Subnets[].[SubnetId,AvailabilityZone,CidrBlock,AvailableIpAddressCount]' --output table | Subnets per AZ and free IPs |
aws ec2 describe-route-tables --filters Name=vpc-id,Values=<vpc> | Where each subnet's traffic goes |
aws ec2 describe-vpc-endpoints | Private endpoints to AWS services |
Remember
5 reserved IPs per subnet | AWS reserves the first four and the last address |
Security groups are stateful | Return traffic is allowed automatically |
NACLs are stateless | Allow both directions, including ephemeral ports |
Instances
aws ec2 describe-instance-types --instance-types m7g.large --query 'InstanceTypes[].[InstanceType,VCpuInfo.DefaultVCpus,MemoryInfo.SizeInMiB]' | vCPU and memory of a type |
aws ec2 describe-instances --filters Name=instance-state-name,Values=running --query 'Reservations[].Instances[].[InstanceId,InstanceType,PrivateIpAddress]' --output table | Running instances |
aws ssm start-session --target i-0123456789abcdef0 | Shell via Session Manager (no SSH, no open ports) |
Auto Scaling
aws autoscaling describe-auto-scaling-groups --query 'AutoScalingGroups[].[AutoScalingGroupName,MinSize,DesiredCapacity,MaxSize]' | Group sizes |
aws autoscaling start-instance-refresh --auto-scaling-group-name <asg> | Roll instances onto a new launch template |
Load balancers
aws elbv2 describe-load-balancers --query 'LoadBalancers[].[LoadBalancerName,Type,DNSName]' --output table | LBs, types and DNS names |
aws elbv2 describe-target-health --target-group-arn <arn> | Which targets are healthy, and why not |
aws acm list-certificates | TLS certificates managed by ACM |
Route 53
aws route53 list-hosted-zones | Public and private zones |
aws route53 list-resource-record-sets --hosted-zone-id <id> | Records in a zone |
dig +short shop.example.com | What resolvers actually return |
S3
aws s3 ls s3://bucket/prefix/ | List objects |
aws s3 sync ./site s3://bucket/site --delete | Sync a folder |
aws s3api get-bucket-versioning --bucket bucket | Is versioning on? |
aws s3api get-public-access-block --bucket bucket | Block Public Access settings |
EBS
aws ec2 describe-volumes --query 'Volumes[].[VolumeId,VolumeType,Size,Iops,Throughput,AvailabilityZone,State]' --output table | Volumes, type, performance, AZ |
aws ec2 modify-volume --volume-id <id> --volume-type gp3 --iops 6000 | Change type/performance online |
aws ec2 create-snapshot --volume-id <id> --description nightly | Snapshot a volume |
KMS & secrets
aws kms list-aliases | Keys by friendly alias |
aws kms describe-key --key-id alias/app-data | Key metadata, state, rotation |
aws secretsmanager get-secret-value --secret-id prod/shop/db --query SecretString --output text | Read a secret (needs permission) |
aws ssm get-parameter --name /prod/shop/db-host --with-decryption | Read a parameter |
Audit & detection
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket | Who deleted a bucket (last 90 days of management events) |
aws guardduty list-detectors | Is GuardDuty enabled in this region? |
aws configservice describe-compliance-by-config-rule | Config rule compliance |
Organizations
aws organizations list-accounts --query 'Accounts[].[Name,Id,Status]' --output table | All accounts (from the management account) |
aws organizations list-policies --filter SERVICE_CONTROL_POLICY | SCPs |
Cost
aws ce get-cost-and-usage --time-period Start=2026-09-01,End=2026-10-01 --granularity MONTHLY --metrics UnblendedCost --group-by Type=DIMENSION,Key=SERVICE | Cost by service for a month |
aws budgets describe-budgets --account-id <id> | Budgets and thresholds |
Tags: Owner, Environment, CostCenter, Application | Minimum tag set for cost allocation |
