The command line interface is one program, aws, that can call every service. Every command has the same shape.

The shape

aws s3api list-buckets --output table

aws, then the service (s3api), then the operation (list-buckets), then parameters that start with two dashes. The service and operation names are the API's own names in lower case with dashes: ListBuckets becomes list-buckets. When you read AWS documentation for an API call, you already know the command.

Some parameters are global and work everywhere: --region, --profile, --output, --query.

Where it gets credentials

The CLI signs every request with an access key: an id and a secret that belong to an identity. aws configure asks for them once and stores them:

~/.aws/credentials      [default]  aws_access_key_id, aws_secret_access_key
~/.aws/config           [default]  region, output

Your CloudShell already has a default profile for the admin user with us-east-1 as its region. A second identity gets a second section, chosen with --profile name. Environment variables such as AWS_REGION override the files for one shell.

aws configure list
aws configure get region
aws configure set output json

Reading an error

An error occurred (NoSuchBucket) when calling the ListObjectsV2 operation: The specified bucket does not exist

Every service error has this shape: an error code in parentheses, the operation that failed, and a sentence. Read the code first. NoSuchBucket, AccessDenied, InvalidParameterValue each point at a different mistake. Errors that come from the CLI itself, such as a missing required parameter, print a usage line instead.

Help

aws help
aws s3api help
aws s3api list-buckets help

Help exists at every level and lists every parameter, which is faster than any search engine once you know the service and operation names.