Free previewConcept guide25 min read10 min setup

CloudShell & CLI Setup

Use AWS CloudShell as the common command-line environment for this course. Whether your computer runs Windows, macOS, or Linux, the commands in the labs can be pasted into CloudShell without translating paths, installing Bash, or changing line continuations.

Why This Course Uses CloudShell

Most AWS examples are written for a Unix-style shell such as Bash or Zsh. macOS and Linux already provide one. Windows normally uses PowerShell or Command Prompt, which differ in quoting, environment variables, pipes, paths, and multiline commands.

Task	Bash / CloudShell	PowerShell
Set a variable	`export AWS_REGION=ap-south-1`	`$env:AWS_REGION = 'ap-south-1'`
Read a variable	`$AWS_REGION`	`$env:AWS_REGION`
Continue a command	Backslash: `\`	Backtick: ` ``
Discard errors	`2>/dev/null`	`2>$null`
Home directory	`$HOME` or `~`	`$HOME` or `$env:USERPROFILE`

One environment for everyone

CloudShell runs Bash in an AWS-managed Linux environment inside your browser. Windows users do not need WSL, Git Bash, or PowerShell translations. macOS and Linux users can also use it to avoid local credential and dependency problems.

Unless a lab explicitly says otherwise, run its AWS CLI commands in CloudShell. Commands that build Docker images or access a private VPC resource may still require a local terminal or an EC2 instance; those labs explain the exception.

What CloudShell Provides

AWS CloudShell is a browser-based shell launched from the AWS Management Console. AWS manages the operating system and preinstalls common tools.

AWS CLI v2 authenticated with the same console identity that launched CloudShell
Bash for the shell syntax used throughout this course
Common tools such as git, curl, wget, zip, unzip, jq, Python, and text editors
A persistent home directory for scripts and small files
Temporary compute with outbound internet access

CloudShell is not your application server

Treat CloudShell as an administration workstation. Do not run production services, long-running jobs, databases, or anything that must remain available after the browser session ends.

What persists

Item	Persists?	What to do
Files under `$HOME`	Yes, within CloudShell storage limits	Keep scripts in `~/aws-course`
Exported environment variables	No	Re-run the lab's resume script
Current directory	No guarantee	Start with `cd ~/aws-course`
AWS resources	Yes	Inventory and clean them up explicitly
Installed system packages	No guarantee	Prefer preinstalled tools or reinstall when needed

An AWS resource such as an S3 bucket or Lambda function is not stored inside CloudShell. Closing CloudShell does not delete it. This is why labs provide cleanup commands and resume scripts.

Launch CloudShell

1Sign in to the AWS Management Console
2Select the region used by the lab, usually ap-south-1 or us-east-1
3Choose the CloudShell terminal icon in the console header
4Wait for the prompt to appear
5Confirm the identity and region before creating anything

bash

aws sts get-caller-identity

echo "Region from environment: ${AWS_REGION:-not set}"
aws configure get region

Check the account before every lab

The account ID from aws sts get-caller-identity must be the account where you intend to create lab resources. This prevents accidental changes in a work or production account.

CloudShell credentials come from your current console session. You normally do not run aws configure or paste access keys into CloudShell.

How to Read Course Commands

Read an AWS CLI command as a predictable structure:

bash

aws <service> <operation> \
  --required-option value \
  --optional-flag \
  --query 'JMESPath expression' \
  --output table

aws invokes AWS CLI v2
<service> selects an API family such as s3api, ec2, or lambda
<operation> selects an API action such as list-buckets or describe-vpcs
Options beginning with -- provide input
--query filters the response before it is printed
--output controls whether the result is JSON, text, YAML, or a table

Multiline commands

A trailing backslash tells Bash that the command continues on the next line. There must be no spaces after the backslash.

bash

aws ec2 describe-vpcs \
  --region "$AWS_REGION" \
  --query 'Vpcs[].{VpcId:VpcId,Default:IsDefault}' \
  --output table

Paste the complete block

Copy every line in a code block and paste it once. If the prompt changes from $ to >, Bash is waiting for the rest of an unfinished quote, bracket, or multiline command. Press Ctrl+C to cancel and paste the complete block again.

Variables, Quotes, and Placeholders

Environment variables

bash

export AWS_REGION="ap-south-1"
export LAB_PREFIX="course-lab-$(date +%s)"
export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

echo "$AWS_REGION"
echo "$LAB_PREFIX"
echo "$ACCOUNT_ID"

export NAME=value creates a variable for the current shell and commands launched from it. Variables disappear when a new CloudShell session starts, so rerun the relevant setup or resume script.

Single quotes and double quotes

Syntax	Behavior	Example
Single quotes	Use the text literally	`'$AWS_REGION'` prints `$AWS_REGION`
Double quotes	Expand variables	`"$AWS_REGION"` prints the value
No quotes	Allows word splitting and wildcard expansion	Avoid for values that may contain spaces

Placeholders

Replace placeholders such as <bucket-name>, your-profile-name, and YOUR_EMAIL before running a command. Do not type the angle brackets unless the lab says they are literal.

Never paste secrets into commands

Commands can be saved in shell history and copied into screenshots or logs. Use Secrets Manager, environment variables, or a temporary file with restricted permissions when a lab needs a sensitive value.

Understand Output and Errors

AWS CLI sends normal results to standard output and errors to standard error. A command also returns an exit status: 0 means success; a non-zero value means failure.

bash

aws sts get-caller-identity

echo "Exit status: $?"

Error	Usually means	First check
`AccessDenied`	The current identity lacks permission	`aws sts get-caller-identity` and the IAM policy
`ResourceNotFoundException`	Wrong name, ARN, account, or region	Print variables and confirm the selected region
`InvalidParameterValue`	An argument has the wrong format	Read the option shown in the error
`ExpiredToken`	The console or CloudShell credentials expired	Refresh the console and restart CloudShell
Command hangs or times out	Network path or endpoint problem	Check internet, NAT, security groups, and VPC endpoints

Debug before rerunning

1Read the complete error, including the operation name
2Run aws sts get-caller-identity
3Print every variable used by the command
4Confirm the region with echo "$AWS_REGION"
5Check whether the resource already exists
6Fix the cause before repeating a create command

Do not add sudo

AWS API permissions are controlled by IAM. Running an AWS CLI command with sudo cannot fix AccessDenied and may create root-owned local files.

Recommended Workflow for Every Lab

1Open CloudShell in the lab's region
2Confirm the AWS account and identity
3Run the prerequisite variables or resume script
4Paste one complete code block at a time
5Read and verify the output before continuing
6Complete the Observe and Checkpoint steps
7Run cleanup when the lab is finished

bash

aws sts get-caller-identity --query '{Account:Account,Arn:Arn}' --output table
printf "Region: %s\n" "${AWS_REGION:-not set}"
printf "Directory: %s\n" "$PWD"

Windows users

Keep this course open in one browser tab and CloudShell in another. Every Bash command can run there exactly as shown. Your local Windows shell is optional unless a lab explicitly requires Docker or local application code.