AWS CLI, S3, and STS: A Comprehensive Guide

In the vast landscape of cloud computing, Amazon Web Services (AWS) stands out as a leading provider. AWS offers a plethora of services, and three of the most commonly used are the AWS Command - Line Interface (CLI), Amazon Simple Storage Service (S3), and AWS Security Token Service (STS). The AWS CLI is a unified tool that allows you to manage your AWS services directly from the command line. Amazon S3 is an object storage service that offers industry - leading scalability, data availability, security, and performance. AWS STS enables you to request temporary, limited - privilege credentials for AWS services. This blog post will explore these three components in detail, providing software engineers with a solid understanding of their core concepts, usage scenarios, common practices, and best practices.

Table of Contents#

  1. Core Concepts
    • AWS CLI
    • Amazon S3
    • AWS STS
  2. Typical Usage Scenarios
    • AWS CLI and S3
    • AWS CLI and STS
    • S3 and STS
  3. Common Practices
    • AWS CLI Configuration
    • S3 Bucket Operations
    • STS Token Generation
  4. Best Practices
    • Security Best Practices
    • Performance Best Practices
  5. Conclusion
  6. FAQ
  7. References

Article#

Core Concepts#

AWS CLI#

The AWS CLI is a command - line tool that enables you to interact with AWS services using commands in your terminal. It provides a consistent interface for managing various AWS resources. You can use the AWS CLI to perform tasks such as creating EC2 instances, managing S3 buckets, and configuring IAM roles. The AWS CLI supports multiple programming languages and can be installed on various operating systems, including Linux, macOS, and Windows.

Amazon S3#

Amazon S3 is a highly scalable object storage service. It allows you to store and retrieve any amount of data at any time from anywhere on the web. S3 stores data as objects within buckets. Each object consists of data, a key (which is a unique identifier for the object), and metadata. S3 offers different storage classes, such as Standard, Standard - Infrequent Access (IA), One Zone - IA, and Glacier, to meet different performance and cost requirements.

AWS STS#

AWS STS is a web service that enables you to request temporary, limited - privilege credentials. These credentials can be used to access AWS resources. STS is useful in scenarios where you want to grant temporary access to AWS resources to users, applications, or services. For example, you can use STS to generate temporary credentials for a mobile application to access an S3 bucket.

Typical Usage Scenarios#

AWS CLI and S3#

  • Data Transfer: You can use the AWS CLI to transfer data between your local machine and an S3 bucket. For example, you can upload a file from your local system to an S3 bucket using the aws s3 cp command.
aws s3 cp local_file.txt s3://my - bucket/
  • Bucket Management: The AWS CLI allows you to create, delete, and list S3 buckets. You can use commands like aws s3 mb (make bucket) and aws s3 rb (remove bucket).
aws s3 mb s3://new - bucket

AWS CLI and STS#

  • Temporary Credentials for Scripts: If you have a script that needs to access AWS resources temporarily, you can use the AWS CLI to generate STS credentials. For example, you can use the aws sts get - session - token command.
aws sts get - session - token
  • Cross - Account Access: The AWS CLI can be used to assume a role in another AWS account using STS. This is useful for scenarios where you need to access resources in a different account.
aws sts assume - role --role - arn arn:aws:iam::123456789012:role/MyRole --role - session - name MySession

S3 and STS#

  • Limited - Time Access to S3 Buckets: You can use STS to grant temporary access to an S3 bucket. For example, a third - party application can request temporary credentials from STS to access a specific S3 bucket for a limited time.

Common Practices#

AWS CLI Configuration#

  • Installation: Install the AWS CLI on your system according to the official documentation.
  • Configuration: Configure the AWS CLI with your AWS access key ID, secret access key, and default region using the aws configure command.
aws configure

S3 Bucket Operations#

  • Bucket Creation: When creating an S3 bucket, choose a unique bucket name globally. Bucket names must follow the DNS naming conventions.
  • Object Upload and Download: Use the appropriate commands to upload and download objects. For large files, consider using the aws s3 sync command for efficient transfers.

STS Token Generation#

  • Understand Token Duration: When generating STS tokens, understand the duration for which the tokens are valid. You can specify the duration when using commands like aws sts get - session - token.

Best Practices#

Security Best Practices#

  • Least Privilege Principle: When using STS, grant only the minimum permissions required for the task. For example, if an application only needs to read objects from an S3 bucket, grant only read - only permissions.
  • Regularly Rotate Credentials: Rotate your AWS access keys and STS tokens regularly to reduce the risk of unauthorized access.

Performance Best Practices#

  • Choose the Right Storage Class: When using S3, choose the appropriate storage class based on your access patterns. For frequently accessed data, use the Standard storage class; for infrequently accessed data, use Standard - IA or One Zone - IA.
  • Optimize Data Transfer: When using the AWS CLI to transfer data between your local machine and S3, optimize the transfer by using parallelization and compression techniques.

Conclusion#

AWS CLI, S3, and STS are powerful tools in the AWS ecosystem. The AWS CLI provides a convenient way to manage AWS resources, S3 offers scalable object storage, and STS enables temporary access to AWS resources. By understanding their core concepts, usage scenarios, common practices, and best practices, software engineers can effectively use these services to build robust and secure applications.

FAQ#

Q1: Can I use the AWS CLI without an AWS account?#

No, you need an AWS account to use the AWS CLI. The AWS CLI uses your AWS credentials (access key ID and secret access key) to authenticate and authorize requests to AWS services.

Q2: How can I secure my S3 buckets?#

You can secure your S3 buckets by enabling bucket policies, using IAM roles, enabling encryption (both server - side and client - side), and enabling multi - factor authentication (MFA) for delete operations.

Q3: What is the maximum duration for an STS token?#

The maximum duration for an STS token varies depending on the method used to generate it. For example, when using aws sts get - session - token, the maximum duration is 36 hours.

References#

2025-10