ECR docker login

Auth Docker to ECR via stdin so the token never lands in shell history

aws ecr get-login-password --region <id> | docker login --username AWS --password-stdin <id>.dkr.ecr.<id>.amazonaws.com

More aws commands

SSM shell without SSH

aws ssm start-session --target i-<id> --region <id>

Open an interactive shell on an instance with no open port 22 or bastion
Tail Lambda/CloudWatch logs

aws logs tail /aws/lambda/<name> --follow --since 10m --format short

Live-stream a log group like tail -f. modern: replaces clunky filter-log-events polling
Simulate IAM policy decision

aws iam simulate-principal-policy --policy-source-arn <id> --action-names s3:GetObject --resource-arns <id> --query 'EvaluationResults[].{action:EvalActionName,decision:EvalDecision}' --output table

Test if a principal can do an action before granting; explains allow/deny
Read a secret value

aws secretsmanager get-secret-value --secret-id <name> --query SecretString --output text | jq -r '.password'

Fetch a JSON secret and extract one field. note: value appears in process args
Cheapest spot price by AZ

aws ec2 describe-spot-price-history --instance-types m6i.large --product-descriptions 'Linux/UNIX' --start-time $(date -u +%Y-%m-%dT%H:%M:%S) --query 'sort_by(SpotPriceHistory,&SpotPrice)[0:5].[AvailabilityZone,SpotPrice]' --output table

Sort current spot history to find the cheapest AZ for an instance type