---
title: "AWS CLI in S3"
sidebar_label: "AWS CLI"
sidebar_position: 3
description: "How to configure AWS CLI and work with storage via the AWS CLI command line interface"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import GrantAccess from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/s3/grant-access.mdx'

# AWS CLI in S3

[AWS CLI](https://aws.amazon.com/ru/cli/) (AWS Command Line Interface) is a command-line interface for working with AWS services.

## Configure AWS CLI \{#configure-aws-cli}

1. [Configure S3 access](#configure-s3-access).
2. [Install the client](#install-client).
3. [Create an AWS CLI configuration](#create-configuration).
4. [Install a certificate](#configure-certificate).

### 1. Configure access to S3 \{#configure-s3-access}

<GrantAccess />

### 2. Install the client \{#install-client}

Use the instructions in the [Install or update to the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) Amazon documentation.

### 3. Create an AWS CLI configuration \{#create-configuration}

1. Open the terminal.

2. Open configuration mode:

   ```bash
   aws configure
   ```

3. Enter the `AWS Access Key ID` — the value of the **Access key** field from the [S3 key](#configure-s3-access).

4. Enter `AWS Secret Access Key` — the value of the **Secret key** field from the S3 key.

5. Enter `Default region name` — the [pool](/infrastructure/locations.mdx#pool) where S3 is located (e.g., `ru-1`).

6. Enter `Default output format` or leave it blank.

7. Settings will be saved in the configuration files:

   * credentials in `.aws/credentials`:

     ```bash
     [default]
     aws_access_key_id = <access_key>
     aws_secret_access_key = <secret_key>
     ```

   * default pool in `.aws/config`:

     ```bash
     [default]
        region = <pool>
     ```

8. In the `.aws/config` configuration file, add the `endpoint_url:` parameter:

   ```bash
   [default]
       region = <pool>
       endpoint_url = https://<s3_domain>
   ```

   Specify `<s3_domain>` — the [S3 API domain](/s3/manage/domains.mdx#s3-api-domains) for the desired pool.

### 4. Install a certificate \{#configure-certificate}

<Tabs queryString="os">
  <TabItem value="ubuntudebian" default>
    <TabItemLabel>
      Linux/macOS
    </TabItemLabel>

    1. Create a folder named `~/.selectels3/`:

       ```
       mkdir -p ~/.selectels3/
       ```

    2. Download the certificate and place it in the `~/.selectels3/` folder:

       ```
       wget https://secure.globalsign.net/cacert/root-r6.crt -O ~/.selectels3/root.crt
       openssl x509 -inform der -in ~/.selectels3/root.crt -out ~/.selectels3/root.crt
       chmod 600 ~/.selectels3/root.crt
       ```

    3. In the `.aws/config` configuration file, add the following parameter:

       ```
       ca_bundle = ~/.selectels3/root.crt
       ```
  </TabItem>

  <TabItem value="windows">
    <TabItemLabel>
      Windows
    </TabItemLabel>

    1. [Download the certificate](https://secure.globalsign.net/cacert/root-r6.crt).
    2. Create a text file, for example, `root.txt`.
    3. Add the certificate content in base64 format to the `root.txt` file.
    4. In the `.aws/config` configuration file, add the following parameter:

       ```
       ca_bundle = <path>
       ```

       Specify `<path>` — the path to the `root.txt` file.
  </TabItem>
</Tabs>

## Working with AWS CLI \{#working-with-aws-cli}

For command syntax, see the [AWS](https://docs.aws.amazon.com/cli/latest/reference/) Amazon documentation.

To work with S3 via AWS CLI, use:

* [s3api](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html) — commands corresponding to operations in the REST API;
* [s3](https://docs.aws.amazon.com/cli/latest/reference/s3/index.html) — additional commands that simplify working with a large number of objects.

### List buckets \{#list-buckets}

1. Open the CLI.
2. List the buckets:

   ```bash
   aws s3 ls
   ```

### Create a bucket \{#create-bucket}

1. Open the CLI.
2. Create a bucket:

   ```bash
   aws s3 mb s3://<bucket_name>
   ```

   Specify `<bucket_name>` — the name of the new bucket.

### List objects \{#view-object-list}

1. Open the CLI.
2. List the objects:

   ```bash
   aws s3 ls --recursive s3://<bucket_name>
   ```

   Specify `<bucket_name>` — the name of the bucket to list objects in.

### Upload an object \{#upload-object}

<Tabs queryString="upload-object">
  <TabItem value="without-condition" default>
    <TabItemLabel>
      Simple upload
    </TabItemLabel>

    1. Open the CLI.
    2. Upload an object to a bucket:

       ```bash
       aws s3 cp <path_to_object> s3://<bucket_name>/
       ```

       Specify:

       * `<path_to_object>` — the path in the bucket where the object will be stored;
       * `<bucket_name>` — the name of the bucket where the object will be stored.
  </TabItem>

  <TabItem value="with-condition">
    <TabItemLabel>
      Upload with conditional request
    </TabItemLabel>

    You can use [conditional requests](/s3/objects/conditional-requests.mdx) when uploading objects via AWS CLI.

    <Tabs queryString="upload-object-with-condition">
      <TabItem value="if-match" default>
        <TabItemLabel>
          Match object existence condition
        </TabItemLabel>

        The object will be uploaded if there is an object in the bucket with an ETag that matches the value from the `If-Match` header. If an object with such an ETag is not found, a `412 Precondition Failed`.

        1. Open the CLI.

        2. Check the ETag of the object that must exist in the bucket for the new object to be uploaded:

           ```bash
           aws s3api head-object \
           --bucket <bucket_name_1> \
           --key <path_to_object_1>
           ```

           Specify:

           * `<bucket_name_1>` — the name of the bucket where the object is stored;
           * `<path_to_object_1>` — the path to the object in the bucket.

        3. Upload an object with a condition:

           ```bash
           aws s3api put-object \
           --bucket <bucket_name_2> \ 
           --key <path_to_object_2> \
           --body <path_to_file> \
           --if-match "<etag>"
           ```

           Specify:

           * `<bucket_name_2>` — the name of the bucket to which the object will be uploaded;
           * `<path_to_object_2>` — the path in the bucket where the object will be stored;
           * `<path_to_file>` — the path to the file on the local device;
           * `<etag>` — the ETag of the object you checked in step 2.
      </TabItem>

      <TabItem value="if-none-match">
        <TabItemLabel>
          Match object non-existence condition
        </TabItemLabel>

        The object will be uploaded if there is no object in the bucket with an ETag that matches the value from the `If-None-Match` header. This prevents the object from being overwritten. If an object with such an ETag already exists in the bucket, a `412 Precondition Failed`.

        1. Open the CLI.
        2. Upload an object with a condition:

           ```bash
           aws s3api put-object \
           --bucket <bucket_name> \
           --key <path_to_object> \
           --body <path_to_file> \
           --if-none-match "*"
           ```

           Specify:

           * `<bucket_name>` — the name of the bucket where the object will be stored;
           * `<path_to_object>` — the path in the bucket where the object will be stored;
           * `<path_to_file>` — the path to the file on the local device.

           Here, `--if-none-match"*"` means that the object will be uploaded only if there is no object at the specified path in the bucket yet.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="with-object-lock">
    <TabItemLabel>
      Upload with Object Lock
    </TabItemLabel>

    If [Object Lock is enabled](/s3/buckets/object-lock.mdx#enable-object-lock) in the bucket, you can upload an object with a temporary lock.

    1. Open the CLI.
    2. Upload an object with a temporary lock:

       ```bash
       aws s3api put-object \
         --bucket <bucket_name> \
         --key <path_to_object> \
         --body <path_to_file> \
         --object-lock-mode <lock_mode> \
         --object-lock-retain-until-date <date>
       ```

       Specify:

       * `<bucket_name>` — the name of the bucket;
       * `<path_to_object>` — the path in the bucket where the object will be stored;
       * `<path_to_file>` — the path to the file on the local device;
       * `<lock_mode>` — [lock mode](/s3/buckets/object-lock.mdx#lock-types-and-modes). Possible values are `GOVERNANCE` or `COMPLIANCE`;
       * `<date>` — the date until which the object will be locked, in ISO 8601 format, for example `2025-09-06T00:00:00Z`. The lock period cannot exceed 100 years or 36500 days.
  </TabItem>
</Tabs>

### Get a link to an object \{#obtain-link-to-object}

You can get a link to an object in a public or private bucket via a signed URL (Presigned URL). Learn more about Presigned URLs in the [Sharing objects with presigned URLs](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html) section of the AWS documentation.

1. Open the CLI.
2. Get the link:

   ```bash
   aws s3 presign s3://<bucket_name>/<path_to_object> --expires-in <time>
   ```

   Specify:

   * `<bucket_name>` — the name of the bucket where the object is stored;
   * `<path_to_object>` — the path to the object in the bucket;
   * optional: `--expires-in <time>` — link expiration time, where `<time>` is the time in seconds after which the link will stop working. If you do not add the `--expires-in <time>` parameter, the link will be valid for one hour.

### Copy an object \{#copy-object}

<Tabs queryString="copy-object">
  <TabItem value="without-condition" default>
    <TabItemLabel>
      Simple copy
    </TabItemLabel>

    1. Open the CLI.
    2. Copy the object:

       ```bash
       aws s3 cp s3://<bucket_name_1>/<path_to_object_1> s3://<bucket_name_2>/<path_to_object_2>
       ```

       Specify:

       * `<bucket_name_1>` — the name of the bucket where the object to copy is stored;
       * `<path_to_object_1>` — the path to the object to copy in the bucket;
       * `<bucket_name_2>` — the name of the bucket to which the object will be copied;
       * `<path_to_object_2>` — the path in the bucket where the object will be stored.
  </TabItem>

  <TabItem value="with-condition">
    <TabItemLabel>
      Copy with condition
    </TabItemLabel>

    You can use [conditional requests](/s3/objects/conditional-requests.mdx) when copying objects via AWS CLI.

    <Tabs>
      <TabItem value="copy-source-if-match">
        <TabItemLabel>
          Object immutability condition
        </TabItemLabel>

        The object will be copied if its ETag matches the value you specify in the `--copy-source-if-match` header — that is, if the object has not been modified. If the object's ETag does not match, a `412 Precondition Failed`.

        1. Open the CLI.
        2. Copy the object with a condition:

           ```bash
           aws s3api copy-object \
           --copy-source <bucket_name_1>/<path_to_object_1> \
           --bucket <bucket_name_2> \
           --key <path_to_object_2> \
           --copy-source-if-match "<etag>" 
           ```

           Specify:

           * `<bucket_name_1>` — the name of the bucket where the object to copy is stored;
           * `<path_to_object_1>` — the path to the object to copy in the bucket;
           * `<bucket_name_2>` — the name of the bucket to which the object will be copied;
           * `<path_to_object_2>` — the path in the bucket where the copied object will be stored;
           * `<etag>` — the ETag that must match the object's ETag.
      </TabItem>

      <TabItem value="copy-source-if-none-match">
        <TabItemLabel>
          Object modification condition
        </TabItemLabel>

        The object will be copied if its ETag does not match the value you specify in the `--copy-source-if-none-match` header — that is, if the object has been modified. If the object's ETag matches, a `412 Precondition Failed`.

        1. Open the CLI.
        2. Copy the object with a condition:

           ```bash
           aws s3api copy-object \
           --copy-source <bucket_name_1>/<path_to_object_1> \
           --bucket <bucket_name_2> \
           --key <path_to_object_2> \
           --copy-source-if-none-match "<etag>" 
           ```

           Specify:

           * `<bucket_name_1>` — the name of the bucket where the object to copy is stored;
           * `<path_to_object_1>` — the path to the object to copy in the bucket;
           * `<bucket_name_2>` — the name of the bucket to which the object will be copied;
           * `<path_to_object_2>` — the path in the bucket where the copied object will be stored;
           * `<etag>` — the ETag that must not match the object's ETag.
      </TabItem>
    </Tabs>
  </TabItem>
</Tabs>

### Delete an object \{#delete-object}

<Tabs queryString="delete-object">
  <TabItem value="without-condition" default>
    <TabItemLabel>
      Simple deletion
    </TabItemLabel>

    1. Open the CLI.
    2. Delete the object:

       ```bash
       aws s3 rm s3://<bucket_name>/<object_name>
       ```

       Specify:

       * `<bucket_name>` — the name of the bucket;
       * `<object_name>` — the name of the object.
  </TabItem>

  <TabItem value="with-condition">
    <TabItemLabel>
      Deletion with condition
    </TabItemLabel>

    You can use [conditional requests](/s3/objects/conditional-requests.mdx) when deleting objects via AWS CLI — this helps reduce the risk of accidentally deleting a file.

    The object will be deleted if there is an object in the bucket with an ETag that matches the value from the `If-Match` header. If an object with such an ETag is not found, a `412 Precondition Failed`.

    1. Open the CLI.

    2. Check the ETag of the object that must exist in the bucket for the required object to be deleted:

       ```bash
       aws s3api head-object \
       --bucket <bucket_name_1> \
       --key <path_to_object_1>
       ```

       Specify:

       * `<bucket_name_1>` — the name of the bucket where the object is stored;
       * `<path_to_object_1>` — the path to the object in the bucket.

    3. Delete the object with a condition:

       ```bash
       aws s3api delete-object \
       --bucket <bucket_name_2> \
       --key <path_to_object_2> \
       --if-match "<etag>"
       ```

       Specify:

       * `<bucket_name_2>` — the name of the bucket where the object is stored;
       * `<path_to_object_2>` — the path to the object in the bucket;
       * `<etag>` — the ETag of the object you checked in step 2.
  </TabItem>
</Tabs>

<Formbricks />