title: “AWS CLI S3 Commands” created: 2026-07-20 updated: 2026-07-20 type: knowledge tags:

aws
s3
cli
devops
certification

AWS CLI S3 Commands

What It Is

The AWS CLI provides two command groups for interacting with S3:

aws s3 — high-level commands (cp, mv, ls, sync, rm) that feel like Unix file operations
aws s3api — low-level 1:1 mapping to S3 API operations (for fine-grained control)

Why It Matters

The CLI is the primary way to interact with S3 from EC2 instances, scripts, and CI/CD pipelines. Exam questions often test whether you understand the correct command and required permissions.

Key Concepts

High-Level Commands (`aws s3`)

Command	Description	Example
`ls`	List buckets or objects	`aws s3 ls s3://mybucket/`
`cp`	Copy file to/from S3	`aws s3 cp file.txt s3://mybucket/`
`mv`	Move (copy + delete source)	`aws s3 mv s3://mybucket/old.txt s3://mybucket/new.txt`
`rm`	Delete an object	`aws s3 rm s3://mybucket/file.txt`
`sync`	Sync directory with bucket	`aws s3 sync ./local/ s3://mybucket/prefix/`
`mb`	Make bucket	`aws s3 mb s3://new-bucket-name`
`rb`	Remove bucket	`aws s3 rb s3://bucket --force`

Required Permissions per Command

CLI Command	S3 Permission Needed
`aws s3 ls`	`s3:ListBucket`
`aws s3 ls s3://bucket/`	`s3:ListBucket`
`aws s3 cp local s3://`	`s3:PutObject`
`aws s3 cp s3:// local`	`s3:GetObject`
`aws s3 rm`	`s3:DeleteObject`

Authentication

On EC2 with an Instance Profile: credentials are automatic (no config needed)
Locally: uses ~/.aws/credentials or environment variables
The CLI checks credentials in this order: env vars → config file → instance profile

Useful Flags

--recursive — apply to all objects under a prefix
--exclude / --include — filter files in sync/cp operations
--dryrun — preview what would happen without executing

Examples

# List all buckets
aws s3 ls

# List objects in a bucket
aws s3 ls s3://reportbucket-123456/

# Upload a file
aws s3 cp report.txt s3://reportbucket-123456/

# Download a file
aws s3 cp s3://reportbucket-123456/report.txt ./report.txt

# Sync a local directory to S3
aws s3 sync ./reports/ s3://reportbucket-123456/reports/ --delete

Gotchas

aws s3 ls (no argument) lists buckets — requires s3:ListAllMyBuckets
aws s3 ls s3://bucket lists objects — requires s3:ListBucket on the bucket
Upload failure usually means missing s3:PutObject permission, not a CLI issue
sync --delete removes destination files not present in source — use carefully

AWS Certification Notes