How to Install AWS CLI on an EC2 Instance (Step-by-Step Tutorial)

Before you can do anything useful with AWS from the command line, you need to make sure the AWS CLI is actually installed and up to date. This tutorial walks through the exact process: update your EC2 security settings, check your current CLI version, upgrade it using pip, verify the upgrade worked, and run a live test against S3 to confirm everything is talking correctly.

In the video, the CLI goes from version 1.14.9 to 1.15.40 in under five minutes. No external downloads. No browser tabs. Just three commands and a confirmation check. Here is exactly how it works.

What You’ll Walk Out With

Why you should run a security update before touching any CLI packages
The exact command to check your current AWS CLI version before upgrading
How to upgrade the AWS CLI using pip on an Amazon Linux EC2 instance
How to verify the upgrade went through without errors
A quick S3 test to prove your CLI is working correctly
What to do next once your CLI is set up and ready
Whether cloud skills fit your specific income path (find out at finder.platformproof.com)

Step 1: Update Your EC2 Security Settings First

The first command in the tutorial is not glamorous, but it matters. Before you install or upgrade anything, run a security update on the instance itself:

sudo yum update

When prompted, type yes and let it run. This pulls the latest security patches for the underlying Amazon Linux operating system. It has nothing to do with the AWS CLI specifically, but it is the responsible thing to do before modifying system packages. If your instance is running outdated kernel packages or has unpatched vulnerabilities, installing or upgrading software on top of that creates unnecessary risk.

Yum is the package manager for Amazon Linux (and Red Hat-based systems generally). The update command tells it to refresh all installed packages against the latest available versions in the repository. Depending on how long since the instance was last updated, this can take anywhere from ten seconds to a few minutes. The tutorial shows it completing without errors, which is the expected outcome on a freshly launched EC2 instance.

One thing worth noting: yum update without any package name updates everything. If you want to update only specific packages, you can specify them by name. But for a general-purpose EC2 instance that you use for AWS CLI work, updating everything is the cleanest approach.

Step 2: Check Your Current AWS CLI Version

Once the security update completes, the next step is to see what version of the AWS CLI is already installed:

aws –version

In the tutorial, this outputs something like: aws-cli/1.14.9 Python/2.7.14 Linux/4.14.77-70.59.amzn1.x86_64 botocore/1.8.21

That output tells you four things at once. The CLI version (1.14.9), the Python version it is running on (2.7.14), the Linux kernel version of the EC2 instance, and the botocore version (the underlying library that handles AWS API calls). All four matter when you are troubleshooting compatibility issues between CLI commands and AWS service APIs.

Version 1.14.9 was the current release on Amazon Linux during early 2018. The CLI has a version 1 and a version 2 series. Version 1 is installed via pip and Python. Version 2 uses a standalone installer and is the current recommended approach as of 2019 onward. This tutorial covers the version 1 upgrade path, which is what came pre-installed on Amazon Linux AMIs at the time.

Checking the version before you upgrade is good practice for one simple reason: if you ever need to roll back or diagnose an issue, you need to know exactly what version was running before you made a change. Copy that output somewhere before you proceed.

Step 3: Switch to Root and Run the Upgrade

The CLI upgrade requires root permissions. The tutorial handles this in two steps. First, switch to the root user:

sudo su

Then run the pip upgrade command:

pip install –upgrade awscli

The sudo su command switches your session to the root user. From that point forward in the session, commands run with full system permissions, which is why the subsequent pip install does not need an additional sudo prefix. On a production instance you would be more cautious about running as root, but for a learning environment or a dedicated CLI instance this is the straightforward path.

Pip is the Python package manager. The AWS CLI version 1 is distributed as a Python package, which means pip can install, upgrade, and uninstall it the same way it handles any other Python library. The –upgrade flag tells pip to check for a newer version and install it if one exists. Without that flag, pip would skip the install if any version is already present.

During the upgrade, you will see pip downloading the new package and its dependencies. It also handles any dependency version conflicts automatically. The whole process runs in the background; you just watch the output scroll and wait for the command prompt to return.

In the tutorial, this completes without any errors or warnings, which is the expected result on a clean Amazon Linux instance. If you are running on Ubuntu or another Linux distribution, the command would be the same but you may need to use pip3 instead of pip depending on your Python configuration.

Step 4: Verify the Upgrade Succeeded

After the upgrade completes, run the version check again to confirm it worked:

aws –version

In the tutorial, the output now shows aws-cli/1.15.40 where it previously showed 1.14.9. That confirms the upgrade from version 1.14.9 to 1.15.40 went through successfully. The Python and botocore versions will also reflect any updates that were pulled in as dependencies.

This second version check is not optional. Do not skip it. Pip can appear to complete successfully while actually leaving the system in a broken state due to permission errors, conflicting dependencies, or path issues. Running aws –version after the upgrade proves that the CLI binary in your current shell path is actually the new version, not a cached reference to the old one.

If the version check still shows the old version number after the upgrade, there are two common causes. Either your shell session is caching the old path and you need to run hash -r to clear it, or the upgrade installed to a different directory than where the shell is looking. In that case, which aws will show you the path the shell is using, and you can compare it to where pip installed the new version.

Not sure if cloud skills fit your income goals?

Answer five questions and get a matched path at finder.platformproof.com.

Step 5: Test It With a Real S3 Command

The final step in the tutorial is to run a real AWS command to confirm the CLI is not just installed but actually able to communicate with AWS services:

aws s3 ls

This command lists all S3 buckets in the AWS account that the EC2 instance has access to. If it returns results or simply returns to the command prompt with no error, the CLI is working. In the tutorial, it runs without any errors, which confirms that the CLI is properly authenticated through the EC2 instance’s IAM role and can reach S3.

The reason this works without manually providing credentials is that the EC2 instance has an IAM role attached to it. When you run an AWS CLI command from inside an EC2 instance that has an instance profile, the CLI automatically retrieves temporary credentials from the EC2 metadata service. You never see this happen; it is handled transparently by the CLI and the AWS SDK underneath it.

If aws s3 ls returns an error like Unable to locate credentials, the instance does not have an IAM role attached, or the role does not include S3 read permissions. Fix that in the IAM console before proceeding with any further CLI work.

Full Command Sequence: Copy and Run

Here is the complete sequence from the tutorial in order. Run these commands one at a time and wait for each to finish before moving to the next:

sudo yum update – update system security packages, type yes when prompted
aws –version – record your current CLI version before upgrading
sudo su – switch to root user for the upgrade
pip install –upgrade awscli – download and install the latest CLI version
aws –version – confirm the new version is active
aws s3 ls – run a live test to confirm the CLI can reach AWS services

Honest Limitations of This Approach

This tutorial was recorded in 2018 using the version 1 CLI on Amazon Linux. A few things have changed since then that are worth knowing about before you follow these exact steps.

AWS released CLI version 2 in 2019. Version 2 is installed differently, uses a standalone installer rather than pip, and is the version AWS now recommends for all new setups. If you are setting up a brand-new environment today, you would likely follow the version 2 installation path instead of the pip upgrade shown here. The version 2 installer is a bundled binary that does not depend on your system Python at all, which eliminates the version conflicts that can happen with the pip approach.

The sudo su approach works but is considered heavier than necessary by many practitioners. An alternative is to use sudo pip install –upgrade awscli without switching to the root user, which runs pip with elevated permissions for that single command only and returns you to your normal user session immediately after.

Python 2 (which the version 1 CLI relied on) reached end of life in January 2020. AWS eventually added Python 3 support to CLI v1 and then moved to Python 3 exclusively in CLI v2. If you are running an older AMI that defaults to Python 2, the commands shown in the tutorial still work, but you are running on an unsupported Python runtime. The practical fix is to either use CLI v2 or ensure your instance is running Python 3.

None of this makes the tutorial wrong. It is a clean, accurate demonstration of the upgrade process for its time. Understanding the context helps you adapt the approach to current AWS recommendations.

Find Your X

Knowing how to work the AWS CLI is a genuine technical skill. But before you invest weeks learning cloud infrastructure, it helps to know whether that is actually the path that leads to income for you specifically, given the skills you already have and the hours you can realistically put in.

The Platform Proof Finder asks you five questions and matches you to the income method most likely to work for your situation. It takes two minutes and it is free. Start at finder.platformproof.com.

Frequently Asked Questions

Does this process work on Ubuntu EC2 instances, not just Amazon Linux?

The general approach works on Ubuntu, but the commands differ slightly. Ubuntu uses apt instead of yum for system updates, and you may need to use pip3 instead of pip depending on your Python configuration. For CLI version 2, the process is the same across Linux distributions since it uses a standalone installer.

Should I use AWS CLI version 1 or version 2 today?

AWS recommends version 2 for all new setups. It installs without pip, does not depend on system Python, and adds features not available in version 1 such as SSO login, AWS profiles with automatic credential refresh, and better output formatting. If you are starting fresh, install version 2 using the official bundled installer from the AWS documentation.

Why does the CLI work without me entering AWS credentials on the EC2 instance?

EC2 instances can have an IAM instance profile attached. When the CLI runs on an instance with a profile, it automatically retrieves temporary credentials from the EC2 metadata endpoint at 169.254.169.254. Those credentials are rotated automatically every few hours. You never need to paste access keys into the instance when you use an instance profile correctly.

What if aws s3 ls returns “Unable to locate credentials”?

This means the instance has no IAM role attached, or the role is attached but has no S3 permissions. Go to the EC2 console, select the instance, click Actions, then Security, then Modify IAM Role. Attach a role that includes at least the AmazonS3ReadOnlyAccess managed policy. You can also configure credentials manually with aws configure, but instance profiles are the preferred approach for EC2 workloads.

Do I need to restart the EC2 instance after upgrading the CLI?

No. The CLI is a user-space tool and the upgrade takes effect immediately in your current shell session. Running aws –version after the upgrade confirms the new version is active without any restart required. If you are in an SSH session, you do not need to reconnect either.

What does the botocore version in the aws –version output mean?

Botocore is the low-level Python library that handles the actual HTTP requests to AWS API endpoints. The AWS CLI is built on top of botocore. When you upgrade the CLI, botocore also upgrades to stay in sync. If an AWS service releases a new API feature and you cannot access it from the CLI, the botocore version is often the thing to check, since new API features require a matching botocore release.

Can I run these commands on a t2.micro free-tier instance?

Yes. The yum update and pip upgrade commands are lightweight operations. A t2.micro instance with 1 GB of RAM handles both without any issue. The only caveat is that if the yum update pulls a large number of package updates, it may take a few extra minutes compared to a larger instance, but it will complete successfully.

What is the next thing to learn after setting up the AWS CLI?

The S3 commands are a natural starting point since aws s3 ls is already working after following this tutorial. From there, aws s3 cp for copying files, aws s3 mb for creating buckets, and aws s3 rm for deleting objects cover most day-to-day S3 tasks. IAM user management via the CLI is another high-value skill since it is something you will need every time you onboard a new team member or service to your AWS account.

Sources

AWS CLI version 1 documentation: pip installation and upgrade instructions
AWS CLI version 2 announcement and migration guide (aws.amazon.com)
Amazon EC2 IAM roles and instance profiles documentation
Python 2 end-of-life announcement (python.org, January 2020)
Botocore library changelog (PyPI)