AWS CloudShell

(1)

AWS CloudShell

User Guide

AWS CloudShell: User Guide

(2)

Amazon's trademarks and trade dress may not be used in connection with any product or service that is not Amazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who may or may not be aﬃliated with, connected to, or sponsored by Amazon.

(3)

What is AWS CloudShell?

AWS CloudShell is a browser-based, pre-authenticated shell that you can launch directly (p. 3)from the AWS Management Console. You can run AWS CLI commands against AWS services using your preferred shell (Bash, PowerShell, or Z shell). And you can do this without needing to download or install command line tools.

When you launch AWS CloudShell, a compute environment (p. 42) that's based on Amazon Linux 2 is created. Within this environment, you've access to an extensive range of pre-installed development tools (p. 42), options for uploading and downloading ﬁles (p. 23), and ﬁle storage that persists between sessions (p. 2).

(Try it now: Tutorial: Getting started with AWS CloudShell (p. 6).)

AWS CloudShell features

AWS Command Line Interface

You launch AWS CloudShell from the AWS Management Console, and the AWS credentials you used to sign in to the console are automatically available in a new shell session. This pre-authentication of AWS CloudShell users allows you to skip conﬁguring credentials when interacting with AWS services using AWS CLI version 2 (pre-installed on the shell's compute environment).

For more information on interacting with AWS services using the command-line interface, see Working with AWS services in AWS CloudShell (p. 27).

Shells and development tools

With the shell that's created for AWS CloudShell sessions, you can switch seamlessly between your preferred command-line shells (p. 22). More speciﬁcally, you can switch between Bash, PowerShell, and Z shell. You also have access to pre-installed tools and utilities such as git, make, pip, sudo, tar, tmux, vim, wget, and zip.

(6)

Persistent storage

The shell environment is pre-conﬁgured with support for leading software languages, enabling you to run Node.js and Python projects, for example, without ﬁrst having to perform runtime installations.

PowerShell users can use the .NET Core runtime.

Files created in or uploaded to AWS CloudShell can also be committed to a local repository before being pushed to a remote repository managed by AWS CodeCommit.

For more information, see AWS CloudShell compute environment: speciﬁcations and software (p. 42).

Persistent storage

When using AWS CloudShell you have persistent storage of 1 GB for each AWS Region at no additional cost. The persistent storage is located in your home directory ($HOME) and is private to you. Unlike ephemeral environment resources that are recycled after each shell session ends, data in your home directory persists between sessions.

For more information about the retention of data in persistent storage, see Persistent storage (p. 57).

Security

The AWS CloudShell environment and its users are protected by speciﬁc security features such as IAM permissions management, shell session restrictions, and Safe Paste for text input.

Permissions management with IAM

Administrators can grant and deny permissions to AWS CloudShell users using IAM policies.

Administrators can also create policies that specify at a granular level the particular actions those users can perform with the shell environment. For more information, see Managing AWS CloudShell access and usage with IAM policies (p. 35).

Shell session management

Inactive and long-running sessions are automatically stopped and recycled. For more information, see Shell sessions (p. 58).

Safe Paste for text input

Enabled by default, Safe Paste is a security feature that asks you to verify that multiline text that you're about to paste into the shell doesn't contain malicious scripts. For more information, see Using Safe Paste for multiline text (p. 31).

Customization options

Your AWS CloudShell experience can be customized by changing screen layouts (multiple tabs), text sizes, and light/dark interface themes. For more information, see Customizing your AWS CloudShell experience (p. 30).

You can also extend your shell environment by installing your own software (p. 49) and modifying start-up shell scripts (p. 50).

Pricing

AWS CloudShell is an AWS service that's available at no additional charge. You pay for any other AWS resources that you run with AWS CloudShell. Standard data transfer rates also apply.

For more information, see Limits and restrictions for AWS CloudShell (p. 57).

(7)

How do I get started?

To start working with the shell, sign in to the AWS Management Console and choose AWS CloudShell from the home page.

For a walkthrough of signing in to the AWS Management Console and performing key tasks with AWS CloudShell, see Tutorial: Getting started with AWS CloudShell (p. 6).

Key AWS CloudShell topics

• Tutorial: Getting started with AWS CloudShell (p. 6)

• Working with AWS CloudShell (p. 21)

• Working with AWS services in AWS CloudShell (p. 27)

• Customizing your AWS CloudShell experience (p. 30)

• AWS CloudShell compute environment: speciﬁcations and software (p. 42)

AWS CloudShell FAQs

Answers to frequently asked questions about this AWS service.

• How do I start with AWS CloudShell? (p. 3)

• What permissions do I need to access AWS CloudShell? (p. 4)

• Which AWS Regions is AWS CloudShell available in? (p. 4)

• What types of shell can I use in AWS CloudShell? (p. 4)

• What web browsers can I use with AWS CloudShell? (p. 4)

• What software is pre-installed on my shell environment? (p. 4)

• Can I install software that's not available in the shell environment? (p. 5)

• Can I restrict the actions that users can perform in AWS CloudShell? (p. 5)

• How can I move data from my home directory if I want to change the AWS Region where I'm using AWS CloudShell? (p. 5)

How do I start with AWS CloudShell?

You can launch AWS CloudShell with a single click from the AWS Management Console. All that's required to get started is to sign in to the console using your AWS or IAM credentials at https://

console.aws.amazon.com/console/home.. You can choose the AWS CloudShell link on the home page or enter "CloudShell" in the Find Services box.

(8)

What permissions do I need to access AWS CloudShell?

For more information, see Tutorial: Getting started with AWS CloudShell (p. 6).

Back to list of FAQs (p. 3)

What permissions do I need to access AWS CloudShell?

Because you access AWS CloudShell from the AWS Management Console, you must be an IAM user who can provide a valid account alias or ID, user name, and password.

To launch AWS CloudShell from the console, you need to have the IAM permissions provided by an attached policy. For more information, see Managing AWS CloudShell access and usage with IAM policies (p. 35).

Which AWS Regions is AWS CloudShell available in?

For a list of supported AWS Regions and associated service endpoints, see the AWS CloudShell page in the Amazon Web Services General Reference.

What types of shell can I use in AWS CloudShell?

You can choose to run commands using the Bash shell, PowerShell, or the Z shell. To switch to a speciﬁc shell, at the command prompt just type the name of the shell program:

• bash: Use the Bash shell

• pwsh: Use PowerShell

• zsh: Use the Z shell

What web browsers can I use with AWS CloudShell?

AWS CloudShell supports the three latest versions of Google Chrome, Mozilla Firefox, Microsoft Edge, and Apple Safari.

What software is pre-installed on my shell environment?

With the shell that's created for AWS CloudShell sessions, you can switch seamlessly between their preferred command-line shells (p. 22) (Bash, PowerShell, and Z shell). They also have access to pre- installed tools and utilities such Make, pip, sudo, tar, tmux, Vim, Wget and Zip.

The shell environment is pre-conﬁgured with support for leading software languages. You can use it to run Node.js and Python projects, for example, without ﬁrst having to perform runtime installations.

PowerShell users can use the .NET Core runtime.

Files created using the shell or uploaded with the shell interface can be added to a version-controlled repository managed using a pre-installed version of Git.

(9)

Can I install software that's not available in the shell environment?

For more information, see Pre-installed software (p. 42).

Can I install software that's not available in the shell environment?

Yes. AWS CloudShell users have sudo privileges so they have administrative rights to install software from the command line. For more information, see Installing third-party software on your shell environment (p. 49).

Can I restrict the actions that users can perform in AWS CloudShell?

Yes. For example, you can allow users to access AWS CloudShell but prevent them from uploading or downloading ﬁles within the shell environment. You can also even completely prevent them from accessing AWS CloudShell. For more information, see Managing AWS CloudShell access and usage with IAM policies (p. 35).

How can I move data from my home directory if I

want to change the AWS Region where I'm using AWS CloudShell?

To move your AWS CloudShell data from one AWS Region to another, you can download the contents of your home directory in Region A to your local machine and then upload from your local machine to the home directory in Region B. For more information on the options available, see Tutorial: Copying multiple ﬁles between your local machine and AWS CloudShell (p. 13).

(10)

Prerequisites

Tutorial: Getting started with AWS CloudShell

This introductory tutorial shows you how to launch AWS CloudShell and perform key tasks using the shell command line interface.

First, you'll sign in to the AWS Management Console and launch AWS CloudShell in a new browser window. You'll then select an AWS Region and a shell type to work with.

Next, you'll create a new folder in your home directory and upload a ﬁle to it from your local machine.

You'll work on that ﬁle using a pre-installed editor before running it as a program from the command line. Finally, you'll call AWS CLI commands to create an Amazon S3 bucket and add your ﬁle as an object to it.

Prerequisites

IAM permissions

The quickest way to obtain permissions for AWS CloudShell is to attach the following AWS managed policy to your IAM identity (user, role, or group):

• AWSCloudShellFullAccess: Provides users with full access to AWS CloudShell and its features.

For this tutorial, you also interact with AWS services (in this case, creating an Amazon S3 bucket and adding an object to it.) So your IAM identity requires a policy that grants, at a minimum, the s3:CreateBucket and s3:PutObject permissions.

For more information, see Amazon S3 Actions in the Amazon Simple Storage Service User Guide.

Exercise ﬁle

This exercise also involves uploading and editing a ﬁle that's then run as a program from the command line interface. Open a text editor on your local machine and add the following code snippet:

import sys

x=int(sys.argv[1]) y=int(sys.argv[2]) sum=x+y

print("The sum is",sum)

Save the ﬁle with the name add_prog.py.

Step 1: Sign in to AWS Management Console

This step involves entering your IAM user information to access the AWS Management Console. If you're already in the console, skip to step 2 (p. 8).

• You can access the AWS Management Console by using an IAM users sign-in URL or going to the main sign-in page.

IAM user sign-in URL

• Open a browser and enter the following sign-in URL, replacing account_alias_or_id with the account alias or account ID provided by your administrator:

https://account_alias_or_id.signin.aws.amazon.com/console/

• Enter your IAM user name and password and choose Sign in.

Main sign-in page

• Open https://aws.amazon.com/console/.

• If you haven't signed in previously using this browser, the main sign-in page appears. Choose IAM user, enter the account alias or account ID, and choose Next.

(12)

Step 2: Launch AWS CloudShell, select a Region, and choose a shell.

• If you already signed in as an IAM user before. Your browser might remember the account alias or account ID for the AWS account. If so, enter your IAM user name and password and choose Sign in.

NoteYou also have the option of signing in as a root user. This identity has complete access to all AWS services and resources in the account. We strongly recommend that you don't use the root user for everyday tasks, even administrative ones. Instead, adhere to the best practice of using the root user only to create your ﬁrst IAM user.

Step 2: Launch AWS CloudShell, select a Region, and choose a shell.

In this step, you launch AWS CloudShell from the console interface, choose an available AWS Region, and switch to your preferred shell (Bash, PowerShell, or Z shell).

1. From the AWS Management Console, you can launch AWS CloudShell by choosing the following options available on the navigation bar:

• Choose the AWS CloudShell icon.

• Start typing "cloudshell" in Search box and then choose the CloudShell option.

(13)

Step 3: Upload a ﬁle to AWS CloudShell

When AWS CloudShell launches in a new browser window for the ﬁrst time, a welcome panel displays and lists key features. After you close this panel, status updates are provided while the shell conﬁgures and forwards your console credentials. When the command prompt displays, the shell is ready for interaction.

NoteIf you encounter issues that prevent you from successfully launching or interacting with AWS CloudShell, check for information to identify and address those issues in Troubleshooting AWS CloudShell (p. 52).

2. To choose an AWS Region to work in, go to the Select a Region menu and select a supported AWS Region (p. 56) to work in. (Available Regions are highlighted.)

Important

If you switch Regions, the interface refreshes and the name of the selected AWS Region is displayed above the command line text. Any files that you add to persistent storage are available only in this same AWS Region. If you change Regions, different storage (and files) are accessible.

3. To choose a pre-installed shell to work with, enter its program name at the command line prompt:

Bash bash

If you switch to Bash, the symbol at the command prompt updates to $.

NoteBash is the default shell that's running when you launch AWS CloudShell.

PowerShell pwsh

If you switch to PowerShell, the symbol at the command prompt updates to PS>.

Z shell zsh

If you switch to Z shell, the symbol at the command prompt updates to %.

Step 3: Upload a ﬁle to AWS CloudShell

This step walks you through the process of uploading a ﬁle and then moving it to a new directory in your home directory.

1. To check your current working directory, at the prompt enter the following command:

pwd

When you press Enter, the shell returns your current working directory. For example: /home/

cloudshell-user.

(14)

Step 4: Edit your ﬁle's code and run it from the command line

2. To upload a ﬁle to this directory, go to Actions and select Upload ﬁle from the menu.

The Upload ﬁle dialog box displays.

3. Choose Browse.

4. In your system's File upload dialog box, select the text ﬁle you created for this tutorial (add_prog.py) and choose Open.

5. In the Upload ﬁle dialog box, choose Upload.

A progress bar tracks the upload. If the upload is successful, a message conﬁrms that add_prog.py was added to the root of your home directory.

6. To create a directory for the ﬁle, enter the make directories command: mkdir mysub_dir.

7. To move the uploaded ﬁle from the root of your home directory to the new directory, use the mv command:

mv add_prog.py mysub_dir.

8. To change your working directory to the new directory, enter cd mysub_dir.

The command prompt updates to indicate you've changed your working directory.

9. To view the contents of the current directory, mysub_dir, enter the ls command.

The contents of the working directory, including the ﬁle you just uploaded, are listed.

Step 4: Edit your ﬁle's code and run it from the command line

This step demonstrates how to use the pre-installed Vim editor to work with a ﬁle. You then run that ﬁle as a program from the command line.

1. To edit the ﬁle you uploaded in the previous step, enter the following command:

vim add_prog.py

(15)

Step 5: Use AWS CLI to add the ﬁle as an object in an Amazon S3 bucket.

The shell interface refreshes to display the Vim editor.

2. To edit the ﬁle in Vim, press the I key. Now edit the contents so the program adds up three numbers instead of two:

import sys

x=int(sys.argv[1]) y=int(sys.argv[2]) z=int(sys.argv[3]) sum=x+y+z

print("The sum is",sum)

Note

If you paste the text into the editor and have the Safe Paste feature (p. 31) enabled, a warning is displayed. Multiline text that's copied can contain malicious scripts. With Safe Paste, you can verify the complete text before it's pasted in. If you're satisﬁed that the text is safe, choose Paste.

3. After you edited the program, press Esc to enter the Vim command mode. Then, enter the following command to save the ﬁle and exit the editor:

:wq Note

If you're new to Vim, you might initially ﬁnd it challenging to switch between command mode (used when saving ﬁles and exiting the application) and insert mode (used when inserting new text). As a friendly point of reference, to enter insert mode, press I, and, to enter command mode, press Esc. For more information about Vim and other tools available in AWS CloudShell, see Development tools and shell utilities (p. 45).

4. Back in the main command line interface, run the program and specify three numbers for input:

python3 add_prog.py 4 5 6

The command line displays the program output: The sum is 15.

Step 5: Use AWS CLI to add the ﬁle as an object in an Amazon S3 bucket.

In this step, you create an Amazon S3 bucket and then use the PutObject method to add your code ﬁle as an object in that bucket.

NoteIn most cases, you can use a service such as CodeCommit (p. 16) to commit a software ﬁle into a version-controlled repository. This introductory tutorial uses Amazon S3 for storage to show how easy it is to use AWS CLI in AWS CloudShell. Using this method, you don't need to download or install any additional resource. Moreover, because you're already authenticated within the shell, you don't need to conﬁgure credentials before making calls.

1. To create a bucket in a speciﬁed AWS Region, enter the following command:

aws s3api create-bucket --bucket insert-unique-bucket-name-here --region us-east-1

NoteIf you're creating a bucket outside of the us-east-1 Region, add create-bucket- configuration with the LocationConstraint parameter to specify the Region. For example:

(16)

AWS CloudShell tutorials

The following tutorials show you how to perform tasks using AWS CloudShell.

Topics

• Tutorial: Copying multiple ﬁles between your local machine and AWS CloudShell (p. 13)

• Tutorial: Using CodeCommit in AWS CloudShell (p. 16)

• Tutorial: Creating a presigned URL for Amazon S3 objects using AWS CloudShell (p. 18)

Tutorial: Copying multiple ﬁles between your local machine and AWS CloudShell

Using the CloudShell interface, you can upload or download a single ﬁle between your local machine and the shell environment at a time. To copy multiple ﬁles between CloudShell and your local machine at the same time, use one of the following options:

• Amazon S3: Use S3 buckets as an intermediary when copying ﬁles between your local machine and CloudShell.

• Zip ﬁles: Compress multiple ﬁles in a single zipped folder that can be uploaded or downloaded using the CloudShell interface.

NoteBecause AWS CloudShell doesn't allow incoming internet traﬃc, it's currently not possible to use commands such as scp or rsync to copy multiple ﬁles between local machines and the CloudShell compute environment.

Uploading and downloading multiple ﬁles using Amazon S3

Prerequisites

To work with buckets and objects, you need an IAM policy that grants permissions to perform the following Amazon S3 API actions:

• s3:CreateBucket

• s3:PutObject

• s3:GetObject

For a complete list of Amazon S3 actions, see Actions in the Amazon Simple Storage Service API Reference.

Upload multiple ﬁles to AWS CloudShell using Amazon S3

1. In AWS CloudShell, create an S3 bucket by running the following s3 command:

aws s3api create-bucket --bucket your-bucket-name --region us-east-1

If the call is successful, the command line displays a response from the S3 service:

(18)

Uploading and downloading multiple ﬁles using Amazon S3

{ "Location": "/your-bucket-name"

}

2. Next, you need to upload the ﬁles in a directory from your local machine to the bucket. You have two options for uploading ﬁles:

• AWS Management Console: Use drag-and-drop to upload ﬁles and folders to a bucket.

• AWS CLI: With the version of the tool installed on your local machine, use the command line to upload ﬁles and folders to the bucket.

Using the console

• Open the Amazon S3 console at https://console.aws.amazon.com/s3/.

(If you're using AWS CloudShell, you should already be logged in to the console.)

• In the Buckets list, choose the name of the bucket that you want to upload your folders or ﬁles to.

• In a window other than the console window, select the ﬁles and folders that you want to upload. Then, drag and drop your selections into the console window that lists the objects in the destination bucket.

The ﬁles you chose are listed on the Upload page.

• Select the check boxes to indicate the ﬁles to be added.

• Choose Upload to add the selected ﬁles to the bucket.

NoteFor information about the full range of conﬁguration options when using the console, see How do I upload ﬁles and folders to an S3 bucket? in the Amazon Simple Storage Service User Guide.

Using AWS CLI

NoteFor this option, you need to have the AWS CLI tool installed on your local machine and have your credentials conﬁgured for calls to AWS services. For more information, see the AWS Command Line Interface User Guide.

• Launch the AWS CLI tool and run the following aws s3 command to sync the speciﬁed bucket with the contents of the current directory on your local machine:

aws s3 sync . s3://your-bucket-name

If the sync is successful, upload messages are displayed for every object added to the bucket.

3. Next, return to the AWS CloudShell command line and enter the following command to synchronize the directory in the shell environment with the contents of the S3 bucket:

aws s3 sync s3://your-bucket-name .

NoteYou can also add --exclude "<value>" and --include "<value>" parameters to to the sync command to perform pattern matching to either exclude or include a particular ﬁle or object.

(19)

Uploading and downloading multiple ﬁles using zipped folders

For more information, see Use of Exclude and Include Filters in the AWS CLI Command Reference.

If the sync is successful, download messages are displayed for every ﬁle downloaded from the bucket to the directory.

Note

With the sync command, only new and updated ﬁles are recursively copied from the source directory to the destination.

Download multiple ﬁles from AWS CloudShell using Amazon S3

1. Using the AWS CloudShell command line, enter the following aws s3 command to sync an S3 bucket with contents of the current directory in the shell environment:

aws s3 sync . s3://your-bucket-name

Note

You can also add --exclude "<value>" and --include "<value>" parameters to the sync command to perform pattern matching to either exclude or include a particular ﬁle or object.

For more information, see Use of Exclude and Include Filters in the AWS CLI Command Reference.

If the sync is successful, upload messages are displayed for every object added to the bucket.

2. Now you need to download the contents of the bucket to your local machine. Because the Amazon S3 console doesn't support the downloading of multiple objects, you need to use the AWS CLI tool that's installed on your local machine.

From the command line of the AWS CLI tool, run the following command:

aws s3 sync s3://your-bucket-name .

If the sync is successful, the command line displays a download message for each ﬁle updated or added in the destination directory.

NoteFor this option, you need to have the AWS CLI tool installed on your local machine and have your credentials conﬁgured for calls to AWS services. For more information, see the AWS Command Line Interface User Guide.

Uploading and downloading multiple ﬁles using zipped folders

With the zip/unzip utilities, you can compress multiple ﬁles in an archive that can be treated as a single ﬁle. The utilities are pre-installed in the CloudShell compute environment.

For more information about pre-installed tools, see Development tools and shell utilities (p. 45).

Upload multiple ﬁles to AWS CloudShell using zipped folders 1. On your local machine, add the ﬁles to be uploaded to a zipped folder.

2. Launch AWS CloudShell and then choose Actions, Upload ﬁle.

3. In the Upload ﬁle dialog box, choose Select ﬁle and choose the zipped folder you just created.

(20)

Tutorial: Using CodeCommit

4. Next, in the Upload ﬁle dialog box, choose Upload to add the selected ﬁle to the shell environment.

5. Next, in the CloudShell command line, run the following command to unzip the contents of the zip archive to a speciﬁed directory:

unzip zipped-files.zip -d my-unzipped-folder

Download multiple ﬁles from AWS CloudShell using zipped folders

1. In the CloudShell command line, running the following command to add all the ﬁles in the current directory to a zipped folder:

zip -r zipped-archive.zip * 2. Next, choose Actions, Download ﬁle.

3. In the Download ﬁle dialog box, enter the path for the zipped folder (/home/cloudshell-user/

zip-folder/zipped-archive.zip, for example) and choose Download.

If the path is correct, a browser dialog oﬀers the choice of opening the zipped folder or saving it to your local machine.

4. On your local machine, you can now unzip the contents of the downloaded zipped folder.

Tutorial: Using CodeCommit in AWS CloudShell

CodeCommit is a secure, highly scalable, and managed source control service that hosts private Git repositories. Using AWS CloudShell, you can work with CodeCommit on the command line using git- remote-codecommit. This utility is pre-installed in the AWS CloudShell compute environment and provides a simple method for pushing and pulling code from CodeCommit repositories. It does this by extending Git. For more information, see the AWS CodeCommit User Guide.

This tutorial describes how to create a CodeCommit repository and clone it to your AWS CloudShell compute environment. This tutorial also shows how you can stage and commit a ﬁle to your cloned repository before pushing it to the remote repository that's managed in AWS Cloud.

Prerequisites

For information about the permissions that an IAM user requires to use AWS CloudShell, see the prerequisites section in the Getting started tutorial (p. 6). You also need IAM permissions to work with CodeCommit.

In addition, before starting you should have the following:

• A basic understanding of Git commands and version control concepts

• A ﬁle in the home directory of your shell that can be committed to the local and remote repositories.

In this tutorial, it's referred to as my-git-file.

Step 1: Create and clone a CodeCommit repository

1. In the AWS CloudShell command line interface, enter the following codecommit command to create a CodeCommit repository called MyDemoRepo:

aws codecommit create-repository --repository-name MyDemoRepo --repository-description "My demonstration repository"

(21)

Step 2: Stage and commit a ﬁle before pushing it to your CodeCommit repository

If the repository is successfully created, the command line displays the service's response:

{ "repositoryMetadata": {

"accountId": "111122223333",

"repositoryId": "0dcd29a8-941a-1111-1111-11111111111a", "repositoryName": "MyDemoRepo",

"repositoryDescription": "My demonstration repository", "lastModifiedDate": "2020-11-23T20:38:23.068000+00:00", "creationDate": "2020-11-23T20:38:23.068000+00:00",

"cloneUrlHttp": "https://git-codecommit.eu-west-1.amazonaws.com/v1/repos/

MyDemoRepo",

"cloneUrlSsh": "ssh://git-codecommit.eu-west-1.amazonaws.com/v1/repos/

MyDemoRepo",

"Arn": "arn:aws:codecommit:eu-west-1:111111111111:MyDemoRepo"

} )

2. Using the command line, create a new directory for your local repository and make it your working directory:

mkdir my-shell-repo cd my-shell-repo

3. Now clone the remote repository using the git clone command. (As you're working with git- remote-codecommit, use the HTTPS (GRC) URL style).

git clone codecommit::eu-west-1://MyDemoRepo

If the repository is successfully cloned, the command line displays the service's response:

Cloning into 'MyDemoRepo'...

warning: You appear to have cloned an empty repository.

4. To navigate to the cloned repository, use the cd command:

cd MyDemoRepo

Step 2: Stage and commit a ﬁle before pushing it to your CodeCommit repository

1. Add a ﬁle called my-git-file to the MyDemoRepo folder using either a Vim editor or the ﬁle upload feature of AWS CloudShell. To learn how to use both, see the Getting started tutorial (p. 6).

2. To stage your ﬁle in the repository, run the git add command:

git add my-git-file

3. To check that the ﬁle has been staged and is ready to be committed, run the git status command:

git status

my-git-file is listed as a new ﬁle and displays in green text, indicating it's ready to be committed.

4. Now commit this version of the staged ﬁle to the repository:

(22)

Tutorial: Creating presigned URLs

git commit -m "first commit to repo"

Note

If you're asked for conﬁguration information to complete the commit, use the following format:

$ git config --global user.name "Jane Doe"

$ git config --global user.email [email protected]

5. Last, to sync your remote repository with the changes made in your local one, push the changes to the upstream branch:

git push

Tutorial: Creating a presigned URL for Amazon S3 objects using AWS CloudShell

This topic shows you how to create a presigned URL to share an Amazon S3 object with others. Because object owners specify their own security credentials when sharing, anyone who receives the presigned URL can access the object for a limited time.

Prerequisites

• IAM user with access permissions provided by the AWSCloudShellFullAccess policy.

• For IAM permissions required to create a presigned URL, see Share an object with others in the Amazon Simple Storage Service User Guide.

Step 1: Create an IAM role to grant access to Amazon S3 Bucket

1. To get your IAM details that can be shared, call the get-caller-identity command from AWS CloudShell:

aws sts get-caller-identity

If the call is successful, the command line displays a response similar to this:

{ "Account": "123456789012",

"UserId": "AROAXXOZUUOTTWDCVIDZ2:redirect_session",

"Arn": "arn:aws:sts::531421766567:assumed-role/Feder08/redirect_session"

}

2. Take the user information that you obtained in the previous step, and add it to an AWS

CloudFormation template. This template creates an IAM role. This role grants your collaborator least-privilege permissions for the shared resources.

Resources:

(23)

Generate the presigned URL

CollaboratorRole:

Type: AWS::IAM::Role Properties:

AssumeRolePolicyDocument:

Version: 2012-10-17 Statement:

- Effect: Allow Principal:

AWS: "arn:aws:iam::531421766567:role/Feder08"

Action: "sts:AssumeRole"

Description: Role used by my collaborators MaxSessionDuration: 7200

CollaboratorPolicy:

Type: AWS::IAM::Policy Properties:

PolicyDocument:

Version: 2012-10-17 Statement:

- Effect: Allow Action:

- 's3:*'

Resource: 'arn:aws:s3:::shared-bucket-for-my-cool-startup' Condition:

StringEquals:

s3:prefix:

- "myfolder/*"

PolicyName: S3ReadSpecificFolder Roles:

- !Ref CollaboratorRole Outputs:

CollaboratorRoleArn:

Description: Arn for the Collaborator's Role Value: !GetAtt CollaboratorRole.Arn

3. Save the AWS CloudFormation template in a ﬁle called template.yaml.

4. Now use the template to deploy the stack and create the IAM role by calling the deploy command:

aws cloudformation deploy --template-file ./template.yaml --stack-name CollaboratorRole --capabilities CAPABILITY_IAM

Generate the presigned URL

1. Using your editor in AWS CloudShell, add the following code. This code creates a URL that provides federated users with direct access to the AWS Management Console.

import urllib, json, sys import requests

import boto3 import os def main():

sts_client = boto3.client('sts')

assume_role_response = sts_client.assume_role(

RoleArn=os.environ.get(ROLE_ARN), RoleSessionName="collaborator-session"

)

credentials = assume_role_response['Credentials']

url_credentials = {}

url_credentials['sessionId'] = credentials.get('AccessKeyId') url_credentials['sessionKey'] = credentials.get('SecretAccessKey') url_credentials['sessionToken'] = credentials.get('SessionToken')

(24)

Generate the presigned URL

json_string_with_temp_credentials = json.dumps(url_credentials) print(f"json string {json_string_with_temp_credentials}") request_parameters = f"?

Action=getSigninToken&Session={urllib.parse.quote(json_string_with_temp_credentials)}"

request_url = "https://signin.aws.amazon.com/federation" + request_parameters r = requests.get(request_url)

signin_token = json.loads(r.text) request_parameters = "?Action=login"

request_parameters += "&Issuer=Example.org"

request_parameters += "&Destination=" + urllib.parse.quote("https://us- west-2.console.aws.amazon.com/cloudshell")

request_parameters += "&SigninToken=" + signin_token["SigninToken"]

request_url = "https://signin.aws.amazon.com/federation" + request_parameters # Send final URL to stdout

print (request_url) if __name__ == "__main__":

main()

2. Save the code in a ﬁle called share.py.

3. Last, run the following from the command line to retrieve the ARN of the IAM role from AWS CloudFormation. Then, use it in the Python script to obtain temporary security credentials:

ROLE_ARN=$(aws cloudformation describe-stacks --stack-name CollaboratorRole --query "Stacks[*].Outputs[?OutputKey=='CollaboratorRoleArn'].OutputValue" --output text) python3 ./share.py

The script returns a URL that a collaborator can click to take them to AWS CloudShell in AWS Management Console. The collaborator has full control over the myfolder/ folder in the Amazon S3 bucket for the next 3,600 seconds (1 hour). The credentials expire after an hour. After this time, the collaborator can no longer access the bucket.

(25)

Launching AWS CloudShell

Working with AWS CloudShell

This topic describes how you can access AWS CloudShell, navigate the shell interface, choose a shell type, work with ﬁle uploads and downloads, and manage your shell sessions.

Launching AWS CloudShell

You can launch AWS CloudShell from the AWS Management Console using either one of the following two methods:

1. Choose the AWS CloudShell icon on the console navigation bar.

2. Start typing "cloudshell" in the Find Services box and then choose the CloudShell option.

Navigating the AWS CloudShell interface

The following screenshot indicates several key AWS CloudShell interface features. You use these features when you use the command line, use ﬁle upload/download tools, customize your shell environment, and access user assistance.

1. AWS CloudShell command line interface that you use to run commands using your preferred shell (p. 22). The current shell type is indicated by the command prompt.

2. The AWS Region where AWS CloudShell is currently running.

(26)

Choosing shells

3. The Notiﬁcation link, which provides access to your Personal Health Dashboard and event logs.

4. The name and account ID of the current AWS CloudShell user (blurred here). You can use this menu to view account information, switch roles, and sign out of AWS.

5. The Region selector that allows you to choose which AWS Region your shell environment runs in. For more information, see Supported AWS Regions for AWS CloudShell (p. 56).

6. The Support menu, which you use to access user-assistance resources, including documentation and training.

7. The Actions menu, which provides options for changing the screen layout (p. 30), downloading and uploading ﬁles (p. 23), and restarting your AWS CloudShell (p. 25).

8. The Preferences option, which you can use to customize your shell experience (p. 30). You do this by changing text size and switching the interface's color theme.

9. The bottom bar, which has options to provide feedback, access localized versions of the interface, and learn about our privacy policy and terms of use.

Choosing your shell

The following shells are pre-installed and ready for use in AWS CloudShell: the Bash shell, PowerShell, and the Z shell. For information about the versions pre-installed in your shell environment, see the shells table (p. 42) in the AWS CloudShell compute environment (p. 42) section.

You can identify the shell that you're currently in by the command prompt:

• $: Bash shell

• PS>: PowerShell

• %: Z shell

To switch to a new shell, enter the shell's program name at the command line prompt:

• bash: Bash

• pwsh: PowerShell

• zsh: Z shell

Working in AWS Regions

The current AWS Region that you're running in is displayed above the command line interface.

You can choose an AWS Region to work in by selecting one from the Region selector. After you change Regions, the interface refreshes as your shell session connects to a compute environment that's running in the selected Region.

(27)

Specifying your default AWS Region for AWS CLI

Important

You have persistent storage of 1 GB for each AWS Region. The persistent storage is located in your home directory ($HOME). Therefore, the personal files, directories, programs, and scripts that are stored in your home directory in one AWS Region. Moreover, they are different from those that are located in the home directory and stored a different Region.

Long-term retention of ﬁles in persistent storage is also managed on a per-Region basis. For more information, see Persistent storage (p. 57).

Specifying your default AWS Region for AWS CLI

You can use environment variables to specify configuration options and credentials required to access AWS services using AWS CLI. The environment variable that specifies the default AWS Region for your shell session is set when you launch AWS CloudShell from a specific Region in the AWS Management Console or when you choose an option in the Region selector.

Because environment variables have precedence over AWS CLI credentials ﬁles that are updated by aws configure, you can't run that command to change the Region that's speciﬁed by the environment variable. To change the default Region for AWS CLI commands, assign a value to the AWS_REGION environment variable. In the examples below, you can replace us-east-1 with your choice of Region.

Bash or Zsh

$ export AWS_REGION=us-east-1

Setting the environment variable changes the value used until the end of your shell session, or until you set the variable to a diﬀerent value. You can make the variables persistent across future sessions by setting them in your shell's startup script.

PowerShell

PS C:\> $Env:AWS_REGION="us-east-1"

If you set an environment variable at the PowerShell prompt, it saves the value for only the duration of the current session. Alternatively, you can set the variable for all future PowerShell sessions by adding it to your PowerShell proﬁle. See the PowerShell documentation for more information about storing environment variables or persisting them across sessions.

To conﬁrm that you've changed the default Region, you can display the current AWS CLI conﬁguration data by running the following command:

aws configure list

Note

For speciﬁc AWS CLI commands, you can override the default Region using the command line option --region. For more information, see Command line options in the AWS Command Line Interface User Guide.

Working with ﬁles and storage

Using AWS CloudShell's interface, you can upload ﬁles to and download ﬁles from the shell environment.

To ensure any of the ﬁles you add are available after your session ends, you should know the diﬀerence between persistent and temporary storage:

(28)

Working with ﬁles and storage

• Persistent storage: You have 1 GB of persistent storage for each AWS Region. Persistent storage is located on your home directory.

• Temporary storage: Temporary storage exists in directories outside your home directory and is recycled at the end of a session.

Important

Files you want to keep and use for future shell sessions should always be left in your home directory. If you move a ﬁle out of your home directory (using the mv command, for example), it's recycled when the current shell session ends.

To download ﬁles from AWS CloudShell 1. Choose Actions, Download ﬁle.

2. In the Download ﬁle dialog box, enter the path for the ﬁle to be downloaded.

NoteYou can use absolute or relative paths when specifying a ﬁle for download. With relative pathnames, /home/cloudshell-user/ is added automatically to the start by default. So to download a ﬁle called mydownload-file, both of the following are valid paths:

• Absolute path: /home/cloudshell-user/subfolder/mydownloadfile.txt

• Relative path: subfolder/mydownloadfile.txt 3. Choose Download.

If the file path is correct, a dialog box displays. You can use this dialog box to open the file with the default application. Or you can save the file to a folder on your local machine.

To upload ﬁles to AWS CloudShell 1. Choose Actions, Upload ﬁle.

NoteBy default, files are uploaded to the root of your home directory: /home/cloudshell- user. If you move files (with the mv command, for example), ensure that the files stay in your home directory. This is where your 1 GB of persistent storage is located.

2. In the Upload ﬁle dialog box, choose Browse to select a ﬁle on your local machine. (The maximum upload size is 1 GB.)

3. In your system Upload ﬁle dialog box, select a ﬁle to upload and choose Open.

(29)

Starting and ending shell sessions

4. Choose Upload to add the selected ﬁle to the shell environment.

If you try to upload a file that causes you to exceed your per-Region limit, you're notified that the upload can't continue. For example, you're told that the upload can't complete if you try to upload a 200MB file when you've already stored 900MB of data in your home directory.

To remove ﬁles from AWS CloudShell

1. To remove ﬁles from AWS CloudShell, use standard shell commands such as rm (remove):

rm my-file-for-removal

2. You can also remove multiple files that meet specified criteria using the find command. The following example removes all files that feature the phrase ".pdf" in their names:

find -type f -name '*pdf*' -delete

NoteIf you stop using AWS CloudShell in an AWS Region, data in that Region's persistent storage is removed automatically after a deﬁned period. For more information, see Persistent storage (p. 57).

Starting and ending shell sessions

NoteAs a security measure, if you don't interact with the shell using the keyboard or pointer for an extended period, the session stops automatically. Very long-running sessions are also automatically stopped. For more information, see Shell sessions (p. 58).

Restarting shell sessions

(30)

Starting and ending shell sessions

1. You can restart a shell session by choosing Actions, Restart CloudShell.

You're notiﬁed that restarting AWS CloudShell stops all active sessions in the current AWS Region.

2. Choose Restart to conﬁrm.

An interface displays a message that the AWS CloudShell compute environment is stopping. After the environment has stopped and restarted, you can start working with the command line in a new session.

NoteIn some cases, it may take a few minutes for your environment to restart.

Manually exiting shell sessions

With the command line, you can leave a shell session and log out using the exit command. You can then press any key to reconnect and continue to use AWS CloudShell.

(31)

AWS CLI command line examples for selected AWS services

Working with AWS services in AWS CloudShell

A key beneﬁt of AWS CloudShell is that you can use it to manage your AWS services from the command line interface. This means that you don't need to download and install tools or conﬁgure your credentials locally beforehand. When you launch AWS CloudShell, a compute environment is created that has the following AWS command line tools already installed:

• AWS CLI (p. 27)

• AWS Elastic Beanstalk CLI (p. 28)

• Amazon ECS CLI (p. 29)

• AWS SAM (p. 29)

And because you’ve already signed into AWS, there's no requirement to conﬁgure your credentials locally before using services. The credentials you used to sign in to the AWS Management Console are forwarded to AWS CloudShell.

If you want to change the default AWS Region used for AWS CLI, you can change the value assigned to the AWS_REGION environment variable. (For more information, see Specifying your default AWS Region for AWS CLI (p. 23).)

The rest of this topic demonstrates how you can start using AWS CloudShell to interact with selected AWS services from the command line.

AWS CLI command line examples for selected AWS services

The following examples represent only some of the numerous AWS services that you can work with using commands available from AWS CLI Version 2. For a full listing, see the AWS CLI Command Reference.

• DynamoDB (p. 27)

• AWS Cloud9 (p. 28)

• Amazon EC2 (p. 28)

• S3 Glacier (p. 28)

DynamoDB

DynamoDB is a fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. This service's implementation of the NoSQL mode supports key-value and document data structures.

The following create-table command creates a NoSQL-style table that's named MusicCollection in your AWS account.

aws dynamodb create-table \ --table-name MusicCollection \

--attribute-definitions AttributeName=Artist,AttributeType=S AttributeName=SongTitle,AttributeType=S \

(32)

AWS Cloud9

--key-schema AttributeName=Artist,KeyType=HASH AttributeName=SongTitle,KeyType=RANGE \ --provisioned-throughput ReadCapacityUnits=5,WriteCapacityUnits=5 \

--tags Key=Owner,Value=blueTeam

For more information, see Using DynamoDB with the AWS CLI in the AWS Command Line Interface User Guide.

AWS Cloud9

AWS Cloud9 is a cloud-based integrated development environment (IDE) that you can use to write, run, and debug your code in a browser window. The environment features a code editor, debugger, and terminal.

The following create-environment-ec2 command creates an AWS Cloud9 EC2 development environment with the speciﬁed settings. It launches an Amazon EC2 instance, and then connects from the instance to the environment.

aws cloud9 create-environment-ec2 --name my-demo-env --description "My demonstration development environment." --instance-type t2.micro --subnet-id subnet-1fab8aEX -- automatic-stop-time-minutes 60 --owner-arn arn:aws:iam::123456789012:user/MyDemoUser

For more information, see AWS Cloud9 command-line reference.

Amazon EC2

Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides secure and resizable compute capacity in the cloud. It's designed to make web-scale cloud computing easier and more accessible.

The following run-instances command launches a t2.micro instance in the speciﬁed subnet of a VPC:

aws ec2 run-instances --image-id ami-xxxxxxxx --count 1 --instance-type t2.micro --key-name MyKeyPair --security-group-ids sg-903004f8 --subnet-id subnet-6e7f829e

For more information, see Using Amazon EC2 with the AWS CLI in the AWS Command Line Interface User Guide.

S3 Glacier

S3 Glacier and S3 Glacier Deep Archive are a secure, durable, and extremely low-cost Amazon S3 cloud storage classes for data archiving and long-term backup.

The following create-vault command creates a vault—a container for storing archives:

aws glacier create-vault --vault-name my-vault --account-id -

For more information, see Using Amazon S3 Glacier with the AWS CLI in the AWS Command Line Interface User Guide.

AWS Elastic Beanstalk CLI

The AWS Elastic Beanstalk CLI provides a command line interface made to simplify creating, updating, and monitoring environments from a local repository. In this context, an environment refers to a collection of AWS resources running an application version.

(33)

Amazon ECS CLI

The following create command creates a new environment in a custom Amazon Virtual Private Cloud (VPC).

$ eb create dev-vpc --vpc.id vpc-0ce8dd99 --vpc.elbsubnets subnet-b356d7c6,subnet-02f74b0c --vpc.ec2subnets subnet-0bb7f0cd,subnet-3b6697c1 --vpc.securitygroup sg-70cff265

For more information, see the EB CLI command reference in the AWS Elastic Beanstalk Developer Guide.

Amazon ECS CLI

The Amazon Elastic Container Service (Amazon ECS) command line interface (CLI) provides several high- level commands. These are designed to simplify the processes of creating, updating, and monitoring clusters and tasks from a local development environment. (An Amazon ECS cluster is a logical grouping of tasks or services.)

The following configure command configures the Amazon ECS CLI to create a cluster configuration named ecs-cli-demo. This cluster configuration uses FARGATE as the default launch type for the ecs- cli-demo cluster in the us-east-1 region.

ecs-cli configure --region us-east-1 --cluster ecs-cli-demo --default-launch-type FARGATE --config-name ecs-cli-demo

For more information, see the Amazon ECS Command Line Reference in the Amazon Elastic Container Service Developer Guide.

AWS SAM CLI

AWS SAM CLI is a command line tool that operates on an AWS Serverless Application Model template and application code. You can perform several tasks using it. These include invoking Lambda functions locally, creating a deployment package for your serverless application, and deploying your serverless application to the AWS Cloud.

The following init command initializes a new SAM project with required parameters passed as parameters:

sam init --runtime python3.7 --dependency-manager pip --app-template hello-world --name sam-app

For more information, see the AWS SAM CLI command reference in the AWS Serverless Application Model Developer Guide.

(34)

Splitting the command line display into multiple tabs

Customizing your AWS CloudShell experience

You can customize the following aspects of your AWS CloudShell experience:

• Tabs layout (p. 30): Split the command line interface into multiple columns and rows.

• Font size (p. 30): Adjust the size of the command line text.

• Color theme (p. 30): Switch between a light and dark theme.

• Safe Paste (p. 30): Enable or disable a feature that requires you to verify multiline text before it's pasted.

You can also extend your shell environment by installing your own software (p. 49) and modifying start-up shell scripts (p. 50).

Splitting the command line display into multiple tabs

With this productivity feature, you can run multiple commands by splitting your command line interface into several panes.

NoteWhen multiple tabbed panes are open, you can select one to work in by clicking anywhere in the pane. You can close a tab by choosing the x symbol next to the Region name.

• Choose Actions and one of the following options from Tabs layout:

• New tab: Add a new tab beside the currently active one.

• Split into rows: Add a new tab in a row below the currently active one.

• Split into columns: Add a new tab in a column beside the currently active one.

If there's not enough space to display each tab fully, scroll bars allow you to navigate the interface.

You can also select the split bars that separate panes and drag them using the pointer to increase or reduce the pane size.

Changing font size

You can increase or decrease the size of the text that's displayed in the command line interface.

1. Choose Preferences, Font Size.

2. Choose a text size between Smallest and Largest.

Changing the interface theme

You can switch between a light and dark theme for the command line interface.

(35)

Using Safe Paste for multiline text

1. Choose Preferences, Color Theme.

2. Choose Light or Dark.

Using Safe Paste for multiline text

Safe Paste is a security feature that asks you to verify that multiline text that you're about to paste into the shell doesn't contain malicious scripts. Text copied from third-party sites can contain hidden code that triggers unexpected behaviors in your shell environment.

The Safe Paste dialog displays the complete text that you've copied to your clipboard. If you're satisﬁed that there's no security risk, you can choose Paste.

We recommend that you enable Safe Paste to catch potential security risks in scripts. But you can switch this feature on or oﬀ by choosing Preferences, Enable Safe Paste/Disable Safe Paste.

(36)

Data protection

Security for AWS CloudShell

Cloud security at Amazon Web Services (AWS) is the highest priority. As an AWS customer, you beneﬁt from a data center and network architecture that is built to meet the requirements of the most security-sensitive organizations. Security is a shared responsibility between AWS and you. The Shared Responsibility Model describes this as Security of the Cloud and Security in the Cloud.

Security of the Cloud – AWS is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud and providing you with services that you can use securely. Our security responsibility is the highest priority at AWS, and the effectiveness of our security is regularly tested and verified by third-party auditors as part of the AWS Compliance Programs.

Security in the Cloud – Your responsibility is determined by the AWS service you are using, and other factors including the sensitivity of your data, your organization’s requirements, and applicable laws and regulations.

AWS CloudShell follows the shared responsibility model through the speciﬁc AWS services it supports.

For AWS service security information, see the AWS service security documentation page and AWS services that are in scope of AWS compliance eﬀorts by compliance program.

The following topics show you how to conﬁgure AWS CloudShell to meet your security and compliance objectives.

Topics

• Data protection in AWS CloudShell (p. 32)

• Identity and access management in AWS CloudShell (p. 33)

• Logging and monitoring in AWS CloudShell (p. 39)

• Compliance validation for AWS CloudShell (p. 40)

• Resilience in AWS CloudShell (p. 40)

• Infrastructure security in AWS CloudShell (p. 41)

• Conﬁguration and vulnerability analysis in AWS CloudShell (p. 41)

• Security best practices for AWS CloudShell (p. 41)

Data protection in AWS CloudShell

The AWS shared responsibility model applies to data protection in AWS CloudShell. As described in this model, AWS is responsible for protecting the global infrastructure that runs all of the AWS Cloud.

You are responsible for maintaining control over your content that is hosted on this infrastructure. This content includes the security conﬁguration and management tasks for the AWS services that you use. For more information about data privacy, see the Data Privacy FAQ. For information about data protection in Europe, see the AWS Shared Responsibility Model and GDPR blog post on the AWS Security Blog.

For data protection purposes, we recommend that you protect AWS account credentials and set up individual user accounts with AWS Identity and Access Management (IAM). That way each user is given only the permissions necessary to fulﬁll their job duties. We also recommend that you secure your data in the following ways:

• Use multi-factor authentication (MFA) with each account.

• Use SSL/TLS to communicate with AWS resources. We recommend TLS 1.2 or later.

(37)

Data encryption

• Set up API and user activity logging with AWS CloudTrail.

• Use AWS encryption solutions, along with all default security controls within AWS services.

• Use advanced managed security services such as Amazon Macie, which assists in discovering and securing personal data that is stored in Amazon S3.

• If you require FIPS 140-2 validated cryptographic modules when accessing AWS through a command line interface or an API, use a FIPS endpoint. For more information about the available FIPS endpoints, see Federal Information Processing Standard (FIPS) 140-2.

We strongly recommend that you never put confidential or sensitive information, such as your customers' email addresses, into tags or free-form fields such as a Name field. This includes when you work with AWS CloudShell or other AWS services using the console, API, AWS CLI, or AWS SDKs. Any data that you enter into tags or free-form fields used for names may be used for billing or diagnostic logs.

If you provide a URL to an external server, we strongly recommend that you do not include credentials information in the URL to validate your request to that server.

Data encryption

Data encryption refers to protecting data when at rest (while stored in AWS CloudShell) and when in transit (as it travels between AWS CloudShell and service endpoints).

Encryption at rest using AWS KMS

Encryption at rest refers to protecting your data from unauthorized access by encrypting data while stored. When using AWS CloudShell, you have persistent storage of 1 GB per AWS Region at no cost.

Persistent storage is located in your home directory ($HOME) and is private to you. Unlike ephemeral environment resources that are recycled after each shell session ends, data in your home directory persists.

The encryption of data stored in AWS CloudShell is implemented using cryptographic keys provided by AWS Key Management Service (AWS KMS). This is a managed AWS service for creating and controlling customer master keys (CMKs)—the encryption keys used to encrypt customer data that’s stored in the AWS CloudShell environment. AWS CloudShell generates and manages cryptographic keys for encrypting data on behalf of customers.

Encryption in transit

Encryption in transit refers to protecting your data from being intercepted while it moves between communication endpoints.

By default, all data communication between the client's web browser computer and the cloud-based AWS CloudShell is encrypted by sending everything through an HTTPS/TLS connection.

You don't need to do anything to enable the use of HTTPS/TLS for communication.

Identity and access management in AWS CloudShell

AWS Identity and Access Management (IAM) is an Amazon Web Services (AWS) service that helps an administrator securely control access to AWS resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use resources in AWS services. IAM is an AWS service that you can use with no additional charge.

AWS CloudShell

AWS CloudShell

User Guide

AWS CloudShell: User Guide

Table of Contents

What is AWS CloudShell?

AWS CloudShell features

AWS Command Line Interface

Shells and development tools

Persistent storage

Security

Customization options

Pricing

How do I get started?

Key AWS CloudShell topics

AWS CloudShell FAQs

How do I start with AWS CloudShell?

What permissions do I need to access AWS CloudShell?

Which AWS Regions is AWS CloudShell available in?

What types of shell can I use in AWS CloudShell?

What web browsers can I use with AWS CloudShell?

What software is pre-installed on my shell environment?

Can I install software that's not available in the shell environment?

Can I restrict the actions that users can perform in AWS CloudShell?

How can I move data from my home directory if I

want to change the AWS Region where I'm using AWS CloudShell?

Tutorial: Getting started with AWS CloudShell

Prerequisites

Contents

Step 1: Sign in to AWS Management Console

Step 2: Launch AWS CloudShell, select a Region, and choose a shell.

Step 3: Upload a ﬁle to AWS CloudShell

Step 4: Edit your ﬁle's code and run it from the command line

Step 5: Use AWS CLI to add the ﬁle as an object in an Amazon S3 bucket.

Related topics

AWS CloudShell tutorials

Tutorial: Copying multiple ﬁles between your local machine and AWS CloudShell

Uploading and downloading multiple ﬁles using Amazon S3

Prerequisites

Uploading and downloading multiple ﬁles using zipped folders

Tutorial: Using CodeCommit in AWS CloudShell

Prerequisites

Step 1: Create and clone a CodeCommit repository

Step 2: Stage and commit a ﬁle before pushing it to your CodeCommit repository

Tutorial: Creating a presigned URL for Amazon S3 objects using AWS CloudShell

Prerequisites

Step 1: Create an IAM role to grant access to Amazon S3 Bucket

Generate the presigned URL

Working with AWS CloudShell

Launching AWS CloudShell

Navigating the AWS CloudShell interface

Choosing your shell

Working in AWS Regions

Specifying your default AWS Region for AWS CLI

Working with ﬁles and storage

Starting and ending shell sessions

Working with AWS services in AWS CloudShell

AWS CLI command line examples for selected AWS services

DynamoDB

AWS Cloud9

Amazon EC2

S3 Glacier

AWS Elastic Beanstalk CLI

Amazon ECS CLI

AWS SAM CLI

Customizing your AWS CloudShell experience

Splitting the command line display into multiple tabs

Changing font size

Changing the interface theme

Using Safe Paste for multiline text

Security for AWS CloudShell

Data protection in AWS CloudShell

Data encryption

Encryption at rest using AWS KMS

Encryption in transit

Identity and access management in AWS CloudShell