[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Getting started](overview.md) > Getting started with the AWS CLI

# Getting started with the AWS CLI in Yandex Object Storage

The [AWS CLI](../tools/aws-cli.md) is one of the most popular tools for working with Object Storage. In this section, you will learn how to use the service with the help of this tool. For guidelines on using the management console, see [Getting started with Yandex Object Storage](../quickstart.md).

To get started with the AWS CLI:

1. [Get your cloud ready](#before-you-begin).
1. [Set up a service account](#create-sa).
1. [Install and configure the AWS CLI](#cli-setup).
1. [Create a bucket](#the-first-bucket).
1. [Upload an object to the bucket](#upload-files).
1. [Get a download link for the file](#get-link).

## Get your cloud ready {#before-you-begin}

{% list tabs group=instructions %}

- Management console {#console}

  1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or sign up if not signed up yet.
  1. On the [**Yandex Cloud Billing**](https://center.yandex.cloud/billing/accounts) page, make sure you have a [billing account](../../billing/concepts/billing-account.md) linked and its status is `ACTIVE` or `TRIAL_ACTIVE`. If you do not have a billing account, [create one](../../billing/quickstart/index.md#create_billing_account).
  1. [Assign](../../iam/operations/roles/grant.md) these _minimum_ roles to your Yandex Cloud account:
      * To create a [service account](../../iam/concepts/users/service-accounts.md) and get access keys for it: [iam.serviceAccounts.admin](../../iam/roles-reference.md#iam-serviceAccounts-admin) for a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). If you want to use an existing service account, the `iam.serviceAccounts.admin` role for that service account will be enough.
      * To assign a role to a service account: [storage.admin](../security/index.md#storage-admin) for a folder.

      If you have a primitive [admin](../../iam/roles-reference.md#admin) role for a folder, you do not need to assign any additional roles.

      {% note info %}
      
      If you cannot manage roles, contact your cloud or organization administrator.
      
      {% endnote %}

{% endlist %}

## Set up a service account {#create-sa}

{% list tabs group=instructions %}

- Management console {#console}

  1. Create a service account:

      1. In the [management console](https://console.yandex.cloud), click ![image](../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).
      1. Navigate to **Identity and Access Management**.
      1. Click **Create service account**.
      1. Enter a name for the service account.
      
         The naming requirements are as follows:
      
         * Length: between 3 and 63 characters.
         * It can only contain lowercase Latin letters, numbers, and hyphens.
         * It must start with a letter and cannot end with a hyphen.
      
         Make sure the service account name is unique within your cloud.
      
      1. Click **Create**.

      You can also use an existing service account.

      For more information, see [Creating a service account](../../iam/operations/sa/create.md).

  1. Assign a [role](../security/index.md#roles-list), e.g., [storage.editor](../security/index.md#storage-editor), for a folder to a service account:

      1. In the [management console](https://console.yandex.cloud), select the cloud or folder.
      1. Navigate to the **Access bindings** tab.
      1. Click **Configure access**.
      1. In the window that opens, select **Service accounts**.
      1. Select the service account from the list or use the search bar.
      1. Click ![image](../../_assets/console-icons/plus.svg) **Add role** and select the role from the list or use the search bar.
      1. Click **Save**.

      For more information, see [Assigning roles to a service account](../../iam/operations/sa/assign-role-for-sa.md).

      {% note info %}
      
      A service account is only allowed to view a list of buckets in the folder it was created in.
      
      A service account can perform actions with objects in buckets that are created in folders different from the service account folder. To enable this, [assign](../../iam/operations/sa/assign-role-for-sa.md) the service account [roles](../security/index.md#service-roles) for the appropriate folder or its bucket.
      
      {% endnote %}

  1. Create a static access key {#create-keys}

      1. In the [management console](https://console.yandex.cloud), navigate to the folder the service account belongs to.
      1. Navigate to **Identity and Access Management**.
      1. In the left-hand panel, select ![FaceRobot](../../_assets/console-icons/face-robot.svg) **Service accounts**.
      1. In the list that opens, select the service account you need.
      1. Click **Create new key** in the top panel.
      1. Select **Create static access key**.
      1. Enter a description for the key and click **Create**.
      1. Save the ID and secret key.

          {% note alert %}

          After you close this dialog, the key value will no longer be available.

          {% endnote %}

      For more information, see [Creating a static access key](../../iam/operations/authentication/manage-access-keys.md#create-access-key).

{% endlist %}

## Install and configure the AWS CLI {#cli-setup}

1. Install the AWS CLI:

    {% list tabs group=operating_system %}

    - Linux {#linux}

      1. In the terminal, run this command:

          ```bash
          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" --output "awscliv2.zip"
          unzip awscliv2.zip
          sudo ./aws/install
          ```

      1. After installation is complete, restart the terminal.

    - macOS {#macos}

      1. In the terminal, run this command:

          ```bash
          curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" --output "AWSCLIV2.pkg"
          sudo installer -pkg AWSCLIV2.pkg -target /
          ```

      1. After installation is complete, restart the terminal.

    - Windows {#windows}

      1. Download the AWS CLI [installation file](https://awscli.amazonaws.com/AWSCLIV2.msi).
      1. Open the file and follow the installer's instructions.

    {% endlist %}

    For more information about installing the AWS CLI, see the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html).

1. Configure the AWS CLI:

    {% list tabs group=instructions %}

    - AWS CLI {#aws-cli}

      1. To configure the AWS CLI, enter this command in the terminal:

          ```bash
          aws configure
          ```

      1. Enter the values for these parameters:

          * `AWS Access Key ID`: Previously obtained static key ID.
          * `AWS Secret Access Key`: Previously obtained secret key.
          * `Default region name`: `ru-central1`.

            To work with Object Storage, always specify the `ru-central1`. A different region value may lead to an authorization error.


          Leave the other parameters unchanged.

          
          You can use Yandex Lockbox to safely store the static key for access to Object Storage. For more information, see [Using a Yandex Lockbox secret to store a static access key](../tutorials/static-key-in-lockbox/index.md).


      1. Set the Object Storage endpoint:

          ```bash
          aws configure set endpoint_url https://storage.yandexcloud.net/
          ```

          {% cut "Examples of final configuration files" %}

          * `~/.aws/config`:



          * `~/.aws/credentials`:

            ```text
            [default]
            aws_access_key_id = <static_key_ID>
            aws_secret_access_key = <secret_key>
            ```

          {% endcut %}

    {% endlist %}

For more information about setting up the AWS CLI, see the [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html).

{% note info %}

Take note of the AWS CLI [features](../tools/aws-cli.md#specifics) when used with Object Storage.

{% endnote %}

## Create a bucket {#the-first-bucket}

{% list tabs group=instructions %}

- AWS CLI {#aws-cli}

  In the terminal, run the command below stating the [bucket](../concepts/bucket.md) name:

  ```bash
  aws s3 mb s3://<bucket_name>
  ```

  For more information, see [Creating a bucket](../operations/buckets/create.md).

{% endlist %}

## Upload an object to the bucket {#upload-files}

{% list tabs group=instructions %}

- AWS CLI {#aws-cli}

  To upload an [object](../concepts/object.md), run the command below stating the path to the local file you need to upload, bucket name, and the [key](../concepts/object.md#key) you will use to store the object in the bucket:

  ```bash
  aws s3 cp <local_file_path>/ s3://<bucket_name>/<object_key>
  ```

  For more information, see [Uploading an object](../operations/objects/upload.md).

{% endlist %}

## Get a download link for the object {#get-link}

{% list tabs group=instructions %}

- AWS CLI {#aws-cli}

  In the terminal, run the command below stating the bucket name, object key, and link lifetime in seconds:

  ```bash
  aws s3 presign s3://<bucket_name>/<object_key> --expires-in <lifetime>
  ```

  You can share the obtained link or use it in your service to access the file.

  For more information, see [Getting a pre-signed URL to download an object](../operations/objects/link-for-download.md).

{% endlist %}

#### See also {#see-also}

* [Getting started with the AWS S3 API in Yandex Object Storage](../s3/s3-api-quickstart.md)