Deploy CloudFormation stack

Idempotent deploy; CAPABILITY_NAMED_IAM required when template creates IAM roles

aws cloudformation deploy --template-file stack.yaml --stack-name <name> --capabilities CAPABILITY_NAMED_IAM --parameter-overrides Env=prod --no-fail-on-empty-changeset
tool
aws14 commands
tags
awsgitopsci

More aws commands

  • Count results with JMESPath
    aws ec2 describe-volumes --filters Name=status,Values=available --query 'length(Volumes[])' --output text --profile staging --region <id>

    Count unattached EBS volumes in one call using length(); --profile/--region scope it

  • Who am I / which account
    aws sts get-caller-identity --query '{acct:Account,arn:Arn}' --output table

    Confirm active account, ARN and assumed role before running risky commands

  • Assume role and export creds
    eval $(aws sts assume-role --role-arn <id> --role-session-name ops --query 'Credentials.[`AWS_ACCESS_KEY_ID=`+AccessKeyId,`AWS_SECRET_ACCESS_KEY=`+SecretAccessKey,`AWS_SESSION_TOKEN=`+SessionToken]' --output text | sed 's/^/export /')

    Assume an IAM role and inject temp creds into the shell env in one shot

  • EC2 instances by tag as table
    aws ec2 describe-instances --filters Name=tag:Env,Values=prod Name=instance-state-name,Values=running --query 'Reservations[].Instances[].{id:InstanceId,ip:PrivateIpAddress,az:Placement.AvailabilityZone}' --output table

    List running prod instances with id, private IP and AZ via JMESPath projection

  • S3 sync with delete + excludes
    aws s3 sync ./ s3://<name>/ --delete --exclude '*.tmp' --exclude '.git/*' --size-only

    Mirror dir to bucket; --delete removes stale keys. note: --size-only skips mtime checks

all 14 aws commands