[Yandex Cloud documentation](../../index.md) > [Yandex Object Storage](../index.md) > [Tools](index.md) > Console clients > AWS CLI

# AWS Command Line Interface (AWS CLI)


The [AWS CLI](https://aws.amazon.com/cli/) is a command line interface designed for AWS services. To learn [how to run commands](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/index.html), see the official Amazon documentation.

To work with Object Storage via the AWS CLI, you can use the following commands:
* [s3api](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/index.html): Commands corresponding to operations in the REST API. Before you start, look through the [list of supported operations](../s3/api-ref/index.md).
* [s3](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3/index.html): Additional commands that make it easier to work with a large number of objects.

## Getting started {#before-you-begin}

1. [Create a service account](../../iam/operations/sa/create.md).
1. [Assign to the service account the roles](../../iam/operations/sa/assign-role-for-sa.md) required for your project, e.g., [storage.editor](../security/index.md#storage-editor) for a bucket (to work with a particular bucket) or a folder (to work with all buckets in this folder). For more information about roles, see [Access management with Yandex Identity and Access Management](../security/index.md).

          
    To work with objects in an [encrypted](../concepts/encryption.md) bucket, a user or [service account](../../iam/concepts/users/service-accounts.md) must have the following [roles for the encryption key](../../kms/operations/key-access.md) in addition to the `storage.configurer` [role](../security/index.md#storage-configurer):
    
    * `kms.keys.encrypter`: To read the key, [encrypt](../../kms/security/index.md#kms-keys-encrypter) and upload objects.
    * `kms.keys.decrypter`: To read the key, [decrypt](../../kms/security/index.md#kms-keys-decrypter) and download objects.
    * `kms.keys.encrypterDecrypter`: This role includes the `kms.keys.encrypter` and `kms.keys.decrypter` [permissions](../../kms/security/index.md#kms-keys-encrypterDecrypter).
    
    For more information, see [Key Management Service service roles](../../kms/security/index.md#service-roles).


1. [Create a static access key](../../iam/operations/authentication/manage-access-keys.md#create-access-key).

    
    As a result, you will get the static access key data. To authenticate in Object Storage, you will need the following:
    
    * `key_id`: Static access key ID
    * `secret`: Secret key
    
    Save `key_id` and `secret`: you will not be able to get the key value again.



To access the HTTP API directly, you need static key authentication, which is supported by the tools listed in [Supported tools](index.md).
  
{% note info %}

You can [disable using static keys for bucket access](../operations/buckets/disable-statickey-auth.md). Once disabled, access will be denied to all tools using this access option: the AWS CLI, SDK, and third-party applications. Access via [ephemeral keys](../security/ephemeral-keys.md), [temporary Security Token Service access keys](../security/sts.md), and [pre-signed URLs](../security/overview.md#pre-signed) will also be disabled. Only access with an [IAM token](../../iam/concepts/authorization/iam-token.md) or [anonymous access](../security/public-access.md) (if enabled) will remain.

{% endnote %}


You can use Yandex Lockbox to safely store the static key for access to Object Storage. For more information, see [Using a Yandex Lockbox secret to store a static access key](../tutorials/static-key-in-lockbox/index.md).

{% note info %}

A service account is only allowed to view a list of buckets in the folder it was created in.

A service account can perform actions with objects in buckets that are created in folders different from the service account folder. To enable this, [assign](../../iam/operations/sa/assign-role-for-sa.md) the service account [roles](../security/index.md#service-roles) for the appropriate folder or its bucket.

{% endnote %}

## Installation {#installation}

To install the AWS CLI, follow the [guide](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) on the vendor's website.

## Configuration {#setup}

To configure the AWS CLI, run the `aws configure` command in your terminal. The command will request values for the following parameters:
1. `AWS Access Key ID`: Static key ID [you got previously](#before-you-begin).
1. `AWS Secret Access Key`: Static key contents [you got previously](#before-you-begin).
1. `Default region name`: `ru-central1`.

    To work with Object Storage, always specify the `ru-central1`. A different region value may lead to an authorization error.

1. Leave the other parameters unchanged.

### Configuration files {#config-files}

The `aws configure` command saves the static key and the region.
* The static key in `.aws/credentials` has the following format:

  ```ini
  [default]
  aws_access_key_id = <static_key_ID>
  aws_secret_access_key = <static_key_contents>
  ```

* The default region in `.aws/config` has the following format:

  ```ini
  [default]
  region = ru-central1
  ```


You can use Yandex Lockbox to safely store the static key for access to Object Storage. For more information, see [Using a Yandex Lockbox secret to store a static access key](../tutorials/static-key-in-lockbox/index.md).


### Setting up an additional profile {#additional-profile}

You can create multiple AWS CLI profiles with the following command:

  ```bash
  aws configure --profile <profile_name>
  ```

The profile data will be saved to the `.aws/credentials` and `.aws/config` files as follows:
* `credentials`:

  ```ini
  [default]
  aws_access_key_id = <ID_of_static_key_1>
  aws_secret_access_key = <contents_of_static_key_1>
  [<name_of_profile_2>]
  aws_access_key_id = <ID_of_static_key_2>
  aws_secret_access_key = <contents_of_static_key_2>
  ...
  [<name_of_profile_n>]
  aws_access_key_id = <ID_of_static_key_n>
  aws_secret_access_key = <contents_of_static_key_n>
  ```

* `config`:

  ```ini
  [default]
  region = ru-central1
  [profile <name_of_profile_2>]
  region = ru-central1
  ...
  [profile <name_of_profile_n>]
  region = ru-central1
  ```

  Where `default` is the default profile.

To switch between profiles, the AWS CLI commands use the `--profile` option, e.g.:

  ```bash
  aws --endpoint-url=https://storage.yandexcloud.net/ \
    --profile <name_of_profile_2> \
    s3 mb s3://<bucket_name>
  ```

## Features {#specifics}

Take note of these AWS CLI features when used with Object Storage:

* The AWS CLI treats Object Storage as a hierarchical file system and object keys look like file paths.
* By default, the client is configured to work with Amazon servers. Therefore, when running the `aws` command to work with Object Storage, make sure to use the `--endpoint-url` parameter. To avoid adding the parameter manually each time you run the command, you can use a configuration file or an alias.
    * In the `.aws/config` configuration file, add the `endpoint_url` parameter (this is supported by the AWS CLI versions 1.29.0, 2.13.0, and higher):

       ```text
       endpoint_url = https://storage.yandexcloud.net
       ```

       This enables you to invoke commands without explicitly specifying an endpoint. For example, you can specify `aws s3 ls` instead of `aws --endpoint-url=https://storage.yandexcloud.net s3 ls`. For more information, see the [AWS CLI](https://docs.aws.amazon.com/sdkref/latest/guide/feature-ss-endpoints.html) documentation.

    * Create an alias using the following command:

      ```bash
      alias ycs3='aws s3 --endpoint-url=https://storage.yandexcloud.net'
      ```

      To create an alias each time you open the terminal, add the `alias` command to the configuration file, which can be either `~/.bashrc` or `~/.zshrc`, depending on the type of shell you are using.

      When using this alias, the following commands are equivalent:

      ```bash
      aws s3 --endpoint-url=https://storage.yandexcloud.net ls
      ```

      ```bash
      ycs3 ls
      ```

## Examples of operations {#aws-cli-examples}

{% note info %}

To enable debug output in the console, use the `--debug` flag.

{% endnote %}

### Create a bucket {#creating-bucket}

```bash
aws s3 mb s3://bucket-name
```

Result:

```text
make_bucket: bucket-name
```

{% note info %}

When creating a bucket, follow the [naming conventions](../concepts/bucket.md#naming).

{% endnote %}

### Uploading objects {#uploading-objects}

You can upload all objects within a directory, use a filter, or upload objects one at a time.
* Upload all objects from a local directory:

  ```bash
  aws s3 cp --recursive local_files/ s3://bucket-name/path_style_prefix/
  ```

  Result:

  ```text
  upload: ./textfile1.log to s3://bucket-name/path_style_prefix/textfile1.log
  upload: ./textfile2.txt to s3://bucket-name/path_style_prefix/textfile2.txt
  upload: ./prefix/textfile3.txt to s3://bucket-name/path_style_prefix/prefix/textfile3.txt
  ```

* Upload objects specified in the `--include` filter and skip objects specified in the `--exclude` filter:

  ```bash
  aws s3 cp --recursive --exclude "*" --include "*.log" \
    local_files/ s3://bucket-name/path_style_prefix/
  ```

  Result:

  ```text
  upload: ./textfile1.log to s3://bucket-name/path_style_prefix/textfile1.log
  ```

* Upload objects one by one, running the following command for each object:

  ```bash
  aws s3 cp testfile.txt s3://bucket-name/path_style_prefix/textfile.txt
  ```

  Result:

  ```text
  upload: ./testfile.txt to s3://bucket-name/path_style_prefix/textfile.txt
  ```

### Getting a list of objects {#getting-objects-list}

```bash
aws s3 ls --recursive s3://bucket-name
```

Result:
```text
2022-09-05 17:10:34      10023 other/test1.png
2022-09-05 17:10:34      57898 other/test2.png
2022-09-05 17:10:34     704651 test.png
```

### Deleting objects {#deleting-objects}

You can delete all objects with a specified prefix, use a filter, or delete objects one at a time.

* Delete all objects with the specified prefix:

  ```bash
  aws s3 rm s3://bucket-name/path_style_prefix/ --recursive
  ```

  Result:

  ```text
  delete: s3://bucket-name/path_style_prefix/test1.png
  delete: s3://bucket-name/path_style_prefix/subprefix/test2.png
  ```

* Delete objects specified in the `--include` filter and skip objects specified in the `--exclude` filter:

  ```bash
  aws s3 rm s3://bucket-name/path_style_prefix/ --recursive \
      --exclude "*" --include "*.log"
  ```

  Result:

  ```text
  delete: s3://bucket-name/path_style_prefix/test1.log
  delete: s3://bucket-name/path_style_prefix/subprefix/test2.log
  ```

* Delete objects one by one, running the following command for each object:

  ```bash
  aws s3 rm s3://bucket-name/path_style_prefix/textfile.txt
  ```

  Result:

  ```text
  delete: s3://bucket-name/path_style_prefix/textfile.txt
  ```

### Retrieving an object {#retrieving-objects}

```bash
aws s3 cp s3://bucket-name/textfile.txt textfile.txt
```
Result:

```text
download: s3://bucket-name/path_style_prefix/textfile.txt to ./textfile.txt
```


## Useful links {#see-also}

* [Getting started with the AWS CLI in Yandex Object Storage](../quickstart/quickstart-aws-cli.md)