Console & CLI

# ===== Four ways to talk to AWS =====
# 1. Console     web GUI; great for exploration + rare ops
# 2. CLI         aws CLI / aws-vault / SAM CLI; great for scripts + quick ops
# 3. SDK         per-language (boto3, aws-sdk-js, aws-sdk-go); great for app code
# 4. IaC         Terraform, CDK, CloudFormation; great for everything reproducible

# ===== When to use each =====
# Console      learning, troubleshooting, one-off resource creation in a dev sandbox
# CLI          repeatable scripts, ops automation, breaking glass actions
# SDK          inside app code (uploading to S3, signing URLs)
# IaC          ANYTHING that runs in production

# Rule of thumb: if you would ever do it twice, IaC. If you would do it once but want history, IaC.

# ===== CLI install + first contact =====
brew install awscli                  # macOS
sudo apt install awscli              # Ubuntu (or Pythonic pip install awscli)
winget install Amazon.AWSCLI         # Windows

aws --version
aws configure                        # access key + region + output

# Prefer aws-vault for secure credential storage:
brew install aws-vault
aws-vault add prod
aws-vault exec prod -- aws sts get-caller-identity

# ===== Profiles =====
# ~/.aws/config:
[profile dev]
region = ap-southeast-2

[profile prod]
region = ap-southeast-2
role_arn = arn:aws:iam::123456789012:role/Admin
source_profile = mfa

# Use:
aws --profile dev s3 ls
AWS_PROFILE=prod aws s3 ls

# ===== Common CLI patterns =====
# JSON / table / text output:
aws ec2 describe-instances --output table
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name]' --output text

# Filter by tag:
aws ec2 describe-instances --filters Name=tag:project,Values=shop --query 'Reservations[*].Instances[*].InstanceId'

# Wait helpers:
aws ec2 wait instance-running --instance-ids i-1234

# Pagination:
aws s3api list-objects-v2 --bucket my-bucket --max-items 100 --starting-token "$NEXT_TOKEN"

# ===== SDK example (Node) =====
import { S3Client, ListObjectsV2Command } from '@aws-sdk/client-s3';
const s3 = new S3Client({ region: 'ap-southeast-2' });
const r = await s3.send(new ListObjectsV2Command({ Bucket: 'my-bucket' }));

# ===== IaC: a Terraform sketch =====
resource "aws_s3_bucket" "app" {
  bucket = "my-app-1234"
}
resource "aws_s3_bucket_public_access_block" "app" {
  bucket                  = aws_s3_bucket.app.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# ===== Patterns to internalise =====
# - Console for read-mostly exploration; IaC for production
# - Profiles + aws-vault + MFA for any non-trivial account
# - --query for ergonomic CLI output; jq for JSON beyond that
# - Tag everything; build queries that filter by tags

# ===== Pitfalls =====
# - Long-lived root or IAM access keys (use roles + SSO)
# - Click-ops in production -> drift from IaC
# - Forgetting to pass --profile -> wrong account hit
# - Console-only changes that bypass review + audit

# Browser: console.aws.amazon.com
# CLI: aws configure  (creates ~/.aws/credentials)
# SDKs for every major language.