DevOps Tutorials, Guides & Best Practices

The current way to install the AWS CLI v2 on Ubuntu is a single command:

curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bashCode language: Bash (bash)

That is the install script AWS now recommends. It downloads, checks, and installs the CLI for the current user into ~/.local/share/aws-cli, then links the aws binary into ~/.local/bin. No sudo required.

Two other paths are officially supported. The zip installer puts the CLI system-wide under /usr/local and lets you pin an exact version. The snap package keeps itself up to date on desktop machines. Each one fails differently, and the failures are easy to avoid once you know which one you picked.

This guide covers all three, the verification steps, credentials setup, updates, removal, and the errors that actually show up on Ubuntu.

Check the prerequisites first

Ubuntu is supported on 64-bit releases. The CLI needs unzip, glibc, groff, and less; the last three ship by default on every desktop and server image you are likely to use. Verify before you start, so a missing utility does not look like a broken install:

lsb_release -a
unzip -v | head -n 1
ldd --version | head -n 1Code language: Bash (bash)

If unzip is missing on a minimal cloud image, install it:

sudo apt update && sudo apt install -y unzipCode language: Bash (bash)

One more thing to know before choosing a method: AWS maintains exactly one third-party package repository for Linux, and it is snap. Anything else that claims to carry the CLI, including apt and pip packages, is either the legacy v1 line or a community build that AWS does not guarantee to be current.

Method 1: the install script (recommended)

curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bashCode language: Bash (bash)

The script works on both x86_64 and ARM, installs for the current user, and leaves your system directories untouched:

The PATH trap. ~/.local/bin is not on PATH by default on Ubuntu. If you skip this step, the install succeeds and aws still returns command not found in a fresh shell:

export PATH="$HOME/.local/bin:$PATH"
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
source ~/.bashrcCode language: Bash (bash)

The installer prints a warning about this when the directory is not on your path. Read that output instead of jumping back to the download page.

Method 2: the zip installer (pin a version, or install system-wide)

Use this when you need a specific release, or when the CLI must be available to every user and every deployment script on the machine.

Intel and AMD (x86_64):

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/installCode language: Bash (bash)

ARM, including Graviton instances and ARM containers:

curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/installCode language: Bash (bash)

The installer writes files to /usr/local/aws-cli and creates the symlink at /usr/local/bin/aws. You can move both:

sudo ./aws/install --install-dir /opt/aws-cli --bin-dir /usr/local/binCode language: Bash (bash)

To upgrade an existing zip installation in place, add --update instead of removing the old one first:

sudo ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --updateCode language: Bash (bash)

If you verify downloads in your pipeline, fetch the matching signature file next to the archive and check it before running the installer:

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip.sig" -o "awscliv2.sig"
gpg --verify awscliv2.sig awscliv2.zipCode language: Bash (bash)

AWS publishes the public key used for these signatures on the same install page. Import it once, then the verification runs offline.

Method 3: snap

sudo snap install aws-cli --classicCode language: Bash (bash)

Snap refreshes the CLI automatically, which is convenient on a workstation and inconvenient on a build agent where you need reproducible versions: there is no support for selecting a minor version, only channels. If your team pins tool versions, use the zip installer instead.

Which method should you pick?

Short recommendation: on a developer laptop or a single-user server, take the install script and fix PATH once. On anything that provisions machines or runs CI, take the zip installer so the version in the image is the version you tested.

Verify the installation

aws --version
# aws-cli/2.27.41 Python/3.11.6 Linux/5.10.205 x86_64

command -v awsCode language: Bash (bash)

The output must start with aws-cli/2. If it starts with aws-cli/1., you are running the legacy v1 that came from apt, pip, or yum, and the shell is finding it before your v2 installation. Remove the old one and check which binary wins:

command -v -a aws
sudo apt remove awscliCode language: Bash (bash)

Configure credentials

aws configure
# AWS Access Key ID [None]:
# AWS Secret Access Key [None]:
# Default region name [None]: eu-central-1
# Default output format [None]: jsonCode language: Bash (bash)

The values land in two files:

• ~/.aws/credentials – access key ID and secret access key, per profile;
• ~/.aws/config – region, output format, and per-profile settings such as a role to assume.

Both files are split into sections, so a second account is just a named profile: aws configure --profile staging, then aws --profile staging s3 ls.

Check what the CLI will actually use, and where each value came from:

aws configure list
aws sts get-caller-identityCode language: Bash (bash)

aws configure list marks each value as coming from a file, an environment variable, or nowhere. That matters, because AWS_ACCESS_KEY_ID, AWS_PROFILE, and AWS_REGION in your shell override the files and are the usual reason a command hits the wrong account.

For account hygiene, the key you paste here should belong to an IAM user or role with the permissions the job needs, not to the root account. If you are winding an account down instead of setting one up, the checks in our guide to closing an AWS account safely cover the same inventory work from the other direction. For organizations, aws configure sso replaces long-term keys with short-lived credentials and is worth the extra setup.

Update and remove the CLI

Installations made with the install script or an official installer update in place:

aws updateCode language: Bash (bash)

If the CLI was installed for all users, run it with sudo. Snap installations refresh on their own, or on demand:

sudo snap refresh aws-cliCode language: Bash (bash)

Removing depends on the method used:

# install script, current user
rm -rf ~/.local/share/aws-cli ~/.local/bin/aws

# zip installer, system-wide
sudo rm -rf /usr/local/aws-cli /usr/local/bin/aws

# snap
sudo snap remove aws-cliCode language: Bash (bash)

Troubleshooting

What to do next

With the CLI working and credentials in place, the useful next step is choosing what to automate rather than installing more tools. AWS Services Explained for Developers maps the services you will touch first, and Essential AWS Features for DevOps Engineers covers the ones that matter for day-to-day operations. If you also deploy to Google Cloud, the same install decision exists there, and Install Google Cloud CLI on Linux and Windows follows the same structure. For teams weighing both providers, AWS vs GCP Services Comparison puts the service names side by side.

Sources

• Installing or updating to the latest version of the AWS CLI – AWS CLI User Guide, install script, zip installer, snap, and update instructions
• Configuration and credential file settings in the AWS CLI – profile sections, file locations, aws configure list
• Troubleshooting errors for the AWS CLI – command not found, wrong version, post-uninstall version
• Installing past releases of the AWS CLI version 2 – versioned archive URLs and --install-dir / --bin-dir / --update flags
• aws-cli on Snapcraft – snap package distribution

FAQ

These answers cover the install decisions that cause the most trouble on Ubuntu: which repository is official, when sudo is required, how updates reach an existing install, where credentials live, and whether ARM machines need a different package.