Command Reference¶

Every command follows the same shape:

aws-cloud-utilities [GLOBAL OPTIONS] COMMAND [SUBCOMMAND] [ARGUMENTS] [OPTIONS]

Global options go before the command name; command options go after it.

aws-cloud-utilities --profile production --region eu-west-1 s3 list-buckets --include-size

Commands¶

Command	Description	Subcommands
account	Account information and management commands.	`contact-info`, `detect-control-tower`, `info`, `limits`, `regions`, `service-regions`, `validate`
awsconfig	AWS Config service management and compliance monitoring commands.	`compliance-checker`, `compliance-status`, `download`, `list-rules`, `show-rules`
bedrock	Amazon Bedrock management commands.	`list-custom-models`, `list-model-jobs`, `list-models`, `model-details`, `regions`
billing	AWS billing and Cost and Usage Report (CUR) management commands.	`cur-create`, `cur-delete`, `cur-details`, `cur-list`, `cur-setup`, `cur-validate-bucket`
cloudformation	AWS CloudFormation management and backup commands.	`backup`, `list-stacks`, `stack-details`
cloudfront	AWS CloudFront distribution management and monitoring commands.	`distribution-details`, `invalidate`, `list-distributions`, `update-logging`
configure	Configure AWS Cloud Utilities settings.	(none)
costops	AWS cost optimization and analysis commands.	`cost-analysis`, `ebs-optimization`, `pricing`, `spot-analysis`, `spot-pricing`, `usage-metrics`
dynamodb	DynamoDB cost and capacity analysis commands.	`cost-analysis`
ecr	AWS ECR (Elastic Container Registry) management commands.	`copy-image`, `create-repository`, `delete-repository`, `get-login`, `list-images`, `list-repositories`
iam	IAM management and auditing commands.	`audit`, `list-policies`, `list-roles`, `policy-details`, `role-details`
info	Show AWS Cloud Utilities information.	(none)
inventory	AWS resource inventory and discovery commands.	`download-all`, `scan`, `services`, `workspaces`
logs	AWS CloudWatch Logs management and processing commands.	`aggregate`, `combine`, `delete-group`, `download`, `list-groups`, `set-retention`
networking	AWS networking and IP management commands.	`ip-ranges`, `ip-summary`
rds	RDS management and troubleshooting commands.	`list-instances`, `troubleshoot-mysql`
s3	AWS S3 bucket and object management commands.	`analyze-encryption`, `bucket-details`, `create-bucket`, `delete-versions`, `download`, `list-buckets`, `nuke-bucket`, `restore-objects`
security	AWS security monitoring and certificate management commands.	`create-certificate`, `list-certificates`, `metrics`
stepfunctions	AWS Step Functions management and monitoring commands.	`describe`, `execute`, `list`, `list-executions`, `logs`
support	AWS support tools commands.	`cases`, `check-level`, `services`, `severity-levels`, `trusted-advisor`
waf	AWS WAF management and troubleshooting commands.	`list`, `stats`, `troubleshoot`

Every command at a glance¶

Command	Description
`aws-cloud-utilities account contact-info`	Get AWS account contact information.
`aws-cloud-utilities account detect-control-tower`	Detect AWS Control Tower or Landing Zone deployments.
`aws-cloud-utilities account info`	Get AWS account information.
`aws-cloud-utilities account limits`	Get AWS service limits and usage.
`aws-cloud-utilities account regions`	List all available AWS regions.
`aws-cloud-utilities account service-regions`	List available regions for a specific AWS service.
`aws-cloud-utilities account validate`	Validate AWS credentials and permissions.
`aws-cloud-utilities awsconfig compliance-checker`	Comprehensive AWS Config compliance checker for various resource types.
`aws-cloud-utilities awsconfig compliance-status`	Get compliance status summary across AWS Config rules and resources.
`aws-cloud-utilities awsconfig download`	Download and process AWS Config files from S3 into CSV or JSON format.
`aws-cloud-utilities awsconfig list-rules`	List AWS Config rules with basic information.
`aws-cloud-utilities awsconfig show-rules`	Show AWS Config rules with compliance metrics and meaningful statistics.
`aws-cloud-utilities bedrock list-custom-models`	List custom Bedrock models.
`aws-cloud-utilities bedrock list-model-jobs`	List Bedrock model customization jobs.
`aws-cloud-utilities bedrock list-models`	List Amazon Bedrock foundation models across regions.
`aws-cloud-utilities bedrock model-details`	Get detailed information about a specific Bedrock model.
`aws-cloud-utilities bedrock regions`	List regions where Amazon Bedrock is available.
`aws-cloud-utilities billing cur-create`	Create a new Cost and Usage Report (CUR 2.0).
`aws-cloud-utilities billing cur-delete`	Delete a Cost and Usage Report.
`aws-cloud-utilities billing cur-details`	Show detailed configuration for a specific CUR report.
`aws-cloud-utilities billing cur-list`	List all existing Cost and Usage Reports.
`aws-cloud-utilities billing cur-setup`	Provision an end-to-end CUR data source (bucket, policy, and report).
`aws-cloud-utilities billing cur-validate-bucket`	Validate S3 bucket permissions for CUR delivery.
`aws-cloud-utilities cloudformation backup`	Backup CloudFormation stacks and templates across regions.
`aws-cloud-utilities cloudformation list-stacks`	List CloudFormation stacks with details.
`aws-cloud-utilities cloudformation stack-details`	Get detailed information about a specific CloudFormation stack.
`aws-cloud-utilities cloudfront distribution-details`	Get detailed information about a specific CloudFront distribution.
`aws-cloud-utilities cloudfront invalidate`	Invalidate CloudFront distribution cache by domain name or distribution ID.
`aws-cloud-utilities cloudfront list-distributions`	List CloudFront distributions with their configuration details.
`aws-cloud-utilities cloudfront update-logging`	Update CloudFront distributions to enable logging and optionally setup alarms.
`aws-cloud-utilities configure`	Configure AWS Cloud Utilities settings.
`aws-cloud-utilities costops cost-analysis`	Analyze AWS costs using Cost Explorer.
`aws-cloud-utilities costops ebs-optimization`	Analyze EBS volumes for cost optimization opportunities.
`aws-cloud-utilities costops pricing`	Get AWS pricing information for services.
`aws-cloud-utilities costops spot-analysis`	Analyze previously collected spot pricing data to find cheapest options.
`aws-cloud-utilities costops spot-pricing`	Collect and analyze EC2 spot pricing data across regions.
`aws-cloud-utilities costops usage-metrics`	Get detailed usage metrics for a specific AWS service.
`aws-cloud-utilities dynamodb cost-analysis`	Analyse DynamoDB tables for capacity usage and estimated monthly cost.
`aws-cloud-utilities ecr copy-image`	Copy a Docker image from any registry to AWS ECR.
`aws-cloud-utilities ecr create-repository`	Create a new ECR repository.
`aws-cloud-utilities ecr delete-repository`	Delete an ECR repository.
`aws-cloud-utilities ecr get-login`	Get Docker login command for ECR or execute login directly.
`aws-cloud-utilities ecr list-images`	List images in an ECR repository.
`aws-cloud-utilities ecr list-repositories`	List ECR repositories with details.
`aws-cloud-utilities iam audit`	Audit IAM roles and policies, saving them locally.
`aws-cloud-utilities iam list-policies`	List IAM policies.
`aws-cloud-utilities iam list-roles`	List IAM roles with details.
`aws-cloud-utilities iam policy-details`	Get detailed information about a specific IAM policy.
`aws-cloud-utilities iam role-details`	Get detailed information about a specific IAM role.
`aws-cloud-utilities info`	Show AWS Cloud Utilities information.
`aws-cloud-utilities inventory download-all`	Download comprehensive inventory of all AWS resources including optional CloudFormation backups.
`aws-cloud-utilities inventory scan`	Comprehensive AWS resource inventory scan across services and regions.
`aws-cloud-utilities inventory services`	List all supported services for inventory scanning.
`aws-cloud-utilities inventory workspaces`	Generate comprehensive WorkSpaces inventory report with optional metrics.
`aws-cloud-utilities logs aggregate`	Aggregate AWS log files into larger files for efficient processing.
`aws-cloud-utilities logs combine`	Combine multiple log files into a single sorted file.
`aws-cloud-utilities logs delete-group`	Delete a CloudWatch log group.
`aws-cloud-utilities logs download`	Download CloudWatch logs for a specific log group or all groups.
`aws-cloud-utilities logs list-groups`	List CloudWatch log groups with details.
`aws-cloud-utilities logs set-retention`	Set retention policy for a CloudWatch log group.
`aws-cloud-utilities networking ip-ranges`	Download and analyze AWS IP ranges.
`aws-cloud-utilities networking ip-summary`	Show summary statistics of AWS IP ranges.
`aws-cloud-utilities rds list-instances`	List RDS instances in the current region.
`aws-cloud-utilities rds troubleshoot-mysql`	Troubleshoot MySQL RDS connection issues.
`aws-cloud-utilities s3 analyze-encryption`	Analyze S3 bucket encryption configurations with parallel processing.
`aws-cloud-utilities s3 bucket-details`	Get comprehensive details about an S3 bucket including configuration and settings.
`aws-cloud-utilities s3 create-bucket`	Create a new S3 bucket with optional configuration.
`aws-cloud-utilities s3 delete-versions`	Delete object versions from an S3 bucket.
`aws-cloud-utilities s3 download`	Download objects from an S3 bucket with parallel processing.
`aws-cloud-utilities s3 list-buckets`	List S3 buckets with details including region and optional size information.
`aws-cloud-utilities s3 nuke-bucket`	Completely delete an S3 bucket and all its contents (including versions).
`aws-cloud-utilities s3 restore-objects`	Restore objects from Glacier or other archive storage classes.
`aws-cloud-utilities security create-certificate`	Create an ACM certificate with Route53 DNS validation.
`aws-cloud-utilities security list-certificates`	List ACM certificates with details.
`aws-cloud-utilities security metrics`	Collect security metrics from AWS WAF, GuardDuty, and Security Hub.
`aws-cloud-utilities stepfunctions describe`	Get detailed information about a Step Functions state machine.
`aws-cloud-utilities stepfunctions execute`	Start an execution of a Step Functions state machine.
`aws-cloud-utilities stepfunctions list`	List all Step Functions state machines.
`aws-cloud-utilities stepfunctions list-executions`	List executions of a Step Functions state machine.
`aws-cloud-utilities stepfunctions logs`	Show CloudWatch logs for a Step Functions execution.
`aws-cloud-utilities support cases`	List AWS support cases.
`aws-cloud-utilities support check-level`	Check AWS support level using different methods.
`aws-cloud-utilities support services`	List AWS services available for support cases.
`aws-cloud-utilities support severity-levels`	List available support severity levels.
`aws-cloud-utilities support trusted-advisor cost-savings`	Analyze AWS Trusted Advisor cost optimization opportunities.
`aws-cloud-utilities waf list`	List all Web ACLs in the account.
`aws-cloud-utilities waf stats`	Get comprehensive WAF statistics for troubleshooting.
`aws-cloud-utilities waf troubleshoot`	Generate comprehensive WAF troubleshooting report.

Output formats¶

--output accepts table (default), json, yaml, and csv. It controls what is printed to the terminal.

aws-cloud-utilities --output json s3 list-buckets
aws-cloud-utilities --output csv iam list-roles

Many commands also take --output-file, which is separate: it writes results to disk and infers the format from the extension (.json, .yaml, .csv). Some commands take --output-dir instead, because they produce many files rather than one.

# Printed as a table, written to disk as JSON
aws-cloud-utilities s3 list-buckets --output-file buckets.json

Discovering options¶

The CLI is self-documenting at every level:

aws-cloud-utilities --help
aws-cloud-utilities s3 --help
aws-cloud-utilities s3 download --help

If this documentation ever disagrees with --help, --help is right. The generated sections of these pages are built from the same command definitions and checked in CI, so the two should not drift.

Commands that write or delete¶

Most commands are read-only. These are not:

Command	Effect	Guard
`s3 nuke-bucket`	Deletes every object, every version, then the bucket	`--dry-run`, `--confirm`, `--download-first`
`s3 delete-versions`	Deletes object versions	`--dry-run`, `--confirm`
`s3 download --delete-after-download`	Deletes objects from S3 after download	none
`logs delete-group`	Deletes a log group and its data	`--confirm`
`logs aggregate --delete-source`	Deletes local source files after aggregating	none
`ecr delete-repository`	Deletes a repository and its images	`--force`, `--confirm`
`billing cur-delete`	Deletes a Cost and Usage Report	`--confirm`
`cloudfront update-logging`	Modifies every distribution in the account	`--dry-run`
`logs set-retention`	Changes retention; shortening it expires existing data	`--dry-run`, `--if-never`

Where --dry-run exists it prints the full plan without making changes. Use it first.

Global options¶

See the CLI Reference for the complete list, and Configuration for how profiles and regions resolve.