7 questions found
What is the AWS Command Line Interface, and why do developers use it instead of only the web console?
Beginner
The AWS Command Line Interface, or CLI, is a unified tool that lets you control AWS services directly from your terminal using text commands, which is especially valuable for automating repetitive tasks, scripting infrastructure changes, and integrating AWS operations into deployment pipelines, since these actions would be far slower and harder to repeat consistently if performed manually through the web console every time.
aws s3 ls s3://my-bucket
Real-world example
A DevOps engineer writes a shell script using the AWS CLI to automatically create a daily snapshot of a database and upload a log file to S3, running that same script every night without any manual console interaction.
Common follow-ups: How do you install and configure the AWS CLI on a new machine?;What is the difference between AWS CLI version 1 and version 2?
IaC (CloudFormation);AWS Systems Manager
How do you configure authentication credentials for the AWS CLI to securely access your AWS account?
Beginner
You typically configure the AWS CLI using the aws configure command, which stores your access key ID and secret access key in a local credentials file, though best practice recommends using named profiles for different accounts or roles, and increasingly, using temporary credentials obtained through IAM Identity Center or assumed roles rather than long lived access keys, to reduce the security risk of leaked credentials.
aws configure --profile production
Real-world example
A consultant working with multiple client AWS accounts sets up a separate named profile for each client using aws configure, allowing them to easily switch between accounts using the --profile flag without needing to reconfigure credentials each time.
Common follow-ups: Why are temporary credentials considered more secure than long lived access keys?;How do you use IAM Identity Center with the AWS CLI?
IAM;AWS Organizations & Multi Account Strategy
What are AWS SDKs, and how do they differ from using the CLI for programmatic access to AWS services?
Intermediate
AWS SDKs are libraries available for popular programming languages such as Python, JavaScript, Java, and Go that let developers interact with AWS services directly from within their application code, providing native language constructs, error handling, and automatic request signing, which is more appropriate for building applications that need to call AWS services as part of their runtime logic, compared to the CLI which is better suited for scripting and manual or automated operational tasks outside of an application's own codebase.
import boto3
s3 = boto3.client('s3')
s3.upload_file('local_file.txt', 'my-bucket', 'remote_file.txt')
Real-world example
A web application uses the AWS SDK for Python, known as boto3, directly within its backend code to upload user uploaded files to S3 as part of handling an HTTP request, rather than shelling out to run CLI commands from within the application.
Common follow-ups: Which AWS SDKs are officially supported, and how do they compare in terms of features?;Can you mix CLI commands and SDK code within the same automation workflow?
AWS Systems Manager;Lambda & Serverless
How does the AWS CLI support output formatting and filtering results using JMESPath queries?
Intermediate
The AWS CLI supports multiple output formats including JSON, table, and text, and it also supports the --query flag, which uses JMESPath syntax to filter and reshape the output directly at the command line, letting you extract exactly the specific fields you need from a large, complex API response without needing to pipe the output into a separate tool for parsing.
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name]' --output table
Real-world example
A systems administrator uses a JMESPath query directly within an AWS CLI command to quickly extract just the instance IDs and current states of all running EC2 instances, without needing to manually parse through a large raw JSON response.
Common follow-ups: What is JMESPath and where else is it used within the AWS ecosystem?;How do you combine --query with --output text for use in shell scripts?
EC2 & Compute;Monitoring (CloudWatch)
How do retry logic and exponential backoff work within AWS SDKs, and why are they important?
Intermediate
AWS SDKs include built in retry logic that automatically retries failed requests, such as those caused by temporary throttling or network issues, using an exponential backoff strategy that gradually increases the wait time between retry attempts, which helps applications gracefully handle transient errors and avoid overwhelming an AWS service that might already be experiencing high load, without requiring developers to manually implement this resilience logic themselves.
import boto3
from botocore.config import Config
config = Config(retries={'max_attempts': 5, 'mode': 'adaptive'})
client = boto3.client('dynamodb', config=config)
Real-world example
A high traffic application configures its DynamoDB SDK client with adaptive retry mode, allowing it to automatically and gracefully handle occasional request throttling during traffic spikes without the application code needing any custom retry handling.
Common follow-ups: What is the difference between standard and adaptive retry modes in the AWS SDK?;How do you determine an appropriate maximum number of retry attempts for a specific use case?
Amazon DynamoDB;Monitoring (CloudWatch)
How can you use AWS CLI and SDK credential chains to securely manage access across local development, CI/CD pipelines, and production environments?
Advanced
AWS CLI and SDKs follow a credential provider chain that checks multiple sources in a defined order, such as environment variables, shared credentials files, and instance or container metadata for assumed roles, which allows the exact same application code to securely authenticate differently depending on where it runs, using a developer's local named profile during development, a CI/CD pipeline's temporary role credentials during deployment, and an EC2 instance role or ECS task role automatically in production, all without hardcoding any credentials.
// No code change needed across environments
// Local: named profile from ~/.aws/credentials
// CI/CD: temporary credentials from OIDC federated role
// Production: EC2 instance role metadata
Real-world example
A development team writes application code once using the default AWS SDK credential chain, and that same code automatically authenticates using a developer's local profile in development, a GitHub Actions OIDC role in the CI/CD pipeline, and an ECS task role in production, without any environment specific code changes.
Common follow-ups: What is the security risk of falling back to hardcoded credentials in code instead of using the credential chain?;How does OIDC federation work for CI/CD pipelines authenticating to AWS?
IAM;AWS CodePipeline
CodeBuild & CodeDeploy (CI/CD)
How do you build robust, idempotent automation scripts using the AWS CLI or SDKs that can safely be run multiple times without causing errors or duplicate resources?
Advanced
Building idempotent automation involves checking whether a resource already exists before attempting to create it, using conditional logic based on the API's own responses, leveraging built in idempotency tokens that many AWS APIs support to safely retry a request without creating duplicate resources, and designing scripts to gracefully handle already exists errors as a successful outcome rather than treating them as failures, ensuring the same script can be safely rerun during a failed deployment recovery without unwanted side effects.
import boto3
client = boto3.client('ec2')
try:
client.create_key_pair(KeyName='my-key')
except client.exceptions.ClientError as e:
if 'InvalidKeyPair.Duplicate' not in str(e):
raise
Real-world example
A deployment automation script checks whether an S3 bucket already exists before attempting to create it, allowing the exact same script to be safely rerun after a partial failure without throwing an unnecessary error about the bucket already existing.
Common follow-ups: What is an idempotency token and which AWS APIs commonly support them?;How do infrastructure as code tools like CloudFormation handle idempotency differently than custom scripts?
IaC (CloudFormation);Auto Scaling Groups