The command line on all three clouds

Why use the command line?

The web console is good for exploring, but slow for repeated work. A command-line interface (CLI) lets you type one line instead of twenty clicks, put commands in a script, run them again tomorrow exactly the same way, and paste them into a runbook (a step-by-step guide for operations). All three clouds have an official CLI, and all three can print JSON, so scripts can read the results.

AWS CLI version 2

The AWS CLI is the aws command. Its configuration lives in two files in your home folder: ~/.aws/config (regions, output format, SSO settings) and ~/.aws/credentials (access keys, if you use them). A profile is a named set of settings, so you can switch between a dev account and a prod account with --profile.

aws configure sso --profile dev          # set up single sign-on (recommended)
aws sso login --profile dev              # get short-lived credentials in the browser
aws sts get-caller-identity --profile dev                # who am I?
aws ec2 describe-instances --profile dev --region ap-south-1 --output table
aws ec2 describe-instances --region ap-south-1 \
  --query "Reservations[].Instances[].[InstanceId,State.Name]" --output text

--region overrides the default region for one command. --output chooses json (the default), table (easy to read) or text (easy for shell scripts). --query filters the result with JMESPath, a small query language for JSON: Reservations[].Instances[].InstanceId means "from every reservation, from every instance, take InstanceId".

Azure CLI

The Azure CLI is the az command. az login opens a browser to sign in. One login can see several subscriptions (billing and access boundaries in Azure), so choose the right one before you change anything.

az login                                            # sign in through the browser
az account list --output table                      # subscriptions you can use
az account set --subscription "Payroll-Prod"        # make one the default
az vm list --resource-group payroll-rg --output table
az group list --query "[?location=='centralindia'].name" --output tsv

Google Cloud CLI

gcloud is the main Google Cloud command (bq for BigQuery and gsutil for older storage scripts also exist). A configuration is a named set of settings: account, project and region. You can keep one per client or environment and switch with one command.

gcloud auth login                                   # sign in your user account
gcloud config configurations create client-a        # a new named configuration
gcloud config set project client-a-prod
gcloud config set compute/region asia-south1
gcloud config configurations list                   # all configurations; one is active
gcloud config configurations activate default       # switch back
gcloud compute instances list --filter="status=RUNNING" --format=json

Cloud shells in the browser

AWS CloudShell, Azure Cloud Shell and Google Cloud Shell give you a terminal in the browser with the CLI already installed and already signed in as you. They are perfect for quick tasks, for learning, and for computers where you cannot install software, such as a college lab.

Keeping credentials safe

A credential is anything that proves who you are: a password, an access key, a token or a key file. If one leaks, an attacker can run up a huge bill or steal data. Bots scan public GitHub repositories for cloud keys within minutes of a push.

• Never put keys in code, config files you commit, container images or chat messages.
• Prefer single sign-on and short-lived credentials: aws sso login, az login and gcloud auth login all give tokens that expire.
• On cloud servers, use roles and attached identities (IAM roles on EC2, managed identities on Azure, attached service accounts on Google Cloud) instead of keys.
• Add secret files to .gitignore, for example .env and *.json key files.
• Turn on secret scanning, for example GitHub secret scanning with push protection, or a tool such as gitleaks in your CI.

# .gitignore
.env
.env.*
*-key.json
.aws/

Scripting with JSON output

Because every CLI can print JSON, you can feed the output into Python or JavaScript: find all running VMs in Mumbai, list buckets without encryption, or count instances per team tag. Use --query or --filter for simple cases, and a small script when the logic grows.

Common mistakes and how to fix them

• Running a command in the wrong account or subscription. Fix: run aws sts get-caller-identity, az account show or gcloud config list first.
• Forgetting --region and creating resources far away. Fix: set a default region in your profile or configuration.
• Parsing table output in scripts. Fix: tables are for people; use json or text output for scripts.
• Sharing one long-lived admin key in a team. Fix: give each person their own SSO login with least-privilege roles.