How to Install AWS CLI on Arch Linux

AWS CLI turns an Arch terminal into a control point for S3, EC2, IAM, CloudWatch, Lambda, and other AWS services. To install AWS CLI on Arch Linux, the cleanest path for most users is the official aws-cli-v2 package from the Arch extra repository because pacman owns the files, dependencies, and updates.

The AWS command-line installer and the aws-cli-bin AUR package are still useful when you specifically want AWS’s pre-built v2 binary or an AUR-managed workflow. The older aws-cli package installs AWS CLI v1 for compatibility with legacy scripts; new setups should use v2 unless a project still depends on v1 behavior.

Install AWS CLI on Arch Linux

Choose one package owner before installing. All methods expose the same aws command name, but they update and remove files differently.

Method	Source	Channel	Updates	Best Fit
Pacman aws-cli-v2	Arch extra	Arch-packaged v2	pacman -Syu	Most users who want AWS CLI v2 managed by Arch packages
Official installer	AWS Linux installer	AWS pre-built v2 binary	Re-run installer with --update	Systems that need the AWS-maintained binary or a release ahead of Arch packaging
AUR aws-cli-bin	AUR package	Community package wrapping AWS’s v2 binary	yay or paru	Users who already manage AUR packages and review PKGBUILDs
Pacman aws-cli	Arch extra	Legacy v1	pacman -Syu	Older automation that still requires AWS CLI v1

Use aws-cli-v2 first unless you have a clear reason to avoid it. The official installer writes under /usr/local/aws-cli and is not tracked by pacman. The AUR package is pacman-managed after build, but it remains community-maintained and should be reviewed like any other AUR package.

AWS CLI v1 and v2 both use the aws command. Do not install multiple AWS CLI methods side by side unless you intentionally manage PATH order and know which binary your scripts call.

Update Arch Linux

Synchronize package databases and bring the system current before installing new packages:

sudo pacman -Syu

Arch is a rolling release, so current package metadata and a fully upgraded base help prevent dependency conflicts.

The commands below use sudo for root-level package and install paths. If your account is not in the sudoers file yet, run the commands as root or follow the guide to add and manage sudo users on Arch Linux.

Method 1: Install AWS CLI v2 via Pacman

The Arch extra repository provides aws-cli-v2, a packaged AWS CLI v2 build that installs the aws command under /usr/bin. This method keeps AWS CLI in the normal pacman upgrade path.

sudo pacman -S aws-cli-v2

The package provides aws-cli, conflicts with the legacy aws-cli package, and installs the aws_completer helper alongside the main binary.

Verify the Pacman Installation

Confirm the command path, version branch, and package owner:

command -v aws
aws --version
pacman -Qo "$(command -v aws)"

Relevant output includes:

/usr/bin/aws
aws-cli/2.34.32 Python/3.14.4 Linux/7.0.3-arch1-2 source/x86_64.arch
/usr/bin/aws is owned by aws-cli-v2 2.34.32-1

Your version, Python branch, and kernel string will change as Arch rolls forward. The 2. version prefix confirms AWS CLI v2, and the source/ marker identifies the Arch-packaged build rather than the AWS pre-built installer.

Install Legacy AWS CLI v1 Only When Needed

If an older script specifically requires AWS CLI v1, install the legacy package instead of aws-cli-v2:

sudo pacman -S aws-cli

The aws-cli package also exposes the aws command. Keep v1 and v2 separate, and remove v1 before switching the same system to aws-cli-v2.

Method 2: Install AWS CLI via the Official Installer

The official AWS installer provides AWS CLI v2 as a pre-built Linux binary. It is useful when you want the AWS-maintained build directly, but pacman will not track the files under /usr/local/aws-cli.

Install Installer Dependencies

Install the tools used to download, verify, and extract the AWS installer:

sudo pacman -S --needed curl unzip gnupg groff less

curl downloads the archive, unzip extracts it, and gnupg verifies the optional AWS signature file. AWS documents groff and less as Linux runtime requirements; install them explicitly on minimal Arch systems.

Confirm the Linux Architecture

AWS publishes separate Linux installers for x86_64 and aarch64. Check your architecture before downloading:

uname -m

x86_64

Use awscli-exe-linux-x86_64.zip for x86_64. If the command prints aarch64, use awscli-exe-linux-aarch64.zip and the matching .sig file instead.

Download the AWS CLI Installer

Download the x86_64 installer and signature file:

AWSCLI_ARCHIVE="awscli-exe-linux-x86_64.zip"
curl -fsSL "https://awscli.amazonaws.com/${AWSCLI_ARCHIVE}" -o awscliv2.zip
curl -fsSL "https://awscli.amazonaws.com/${AWSCLI_ARCHIVE}.sig" -o awscliv2.sig
test -s awscliv2.zip && echo "awscliv2.zip downloaded"

awscliv2.zip downloaded

For an ARM64 Arch system, change AWSCLI_ARCHIVE to awscli-exe-linux-aarch64.zip before running the same commands.

Verify the Installer Signature

AWS signs the installer zip with a PGP signature. Import the AWS CLI public key from the official AWS CLI install instructions, then confirm the fingerprint matches FB5D B77F D5C1 18B8 0511 ADA8 A631 0ACC 4672 475C:

curl -fsSL "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.md" \
  | sed -n '/BEGIN PGP PUBLIC KEY BLOCK/,/END PGP PUBLIC KEY BLOCK/p' \
  | sed 's/^[[:space:]]*//' > awscliv2-public-key.asc
test -s awscliv2-public-key.asc
gpg --import awscliv2-public-key.asc
gpg --fingerprint A6310ACC4672475C

After the fingerprint matches, verify the downloaded archive against its signature file:

gpg --verify awscliv2.sig awscliv2.zip

Relevant output includes:

gpg:                using RSA key FB5DB77FD5C118B80511ADA8A6310ACC4672475C
gpg: Good signature from "AWS CLI Team <aws-cli@amazon.com>" [unknown]
Primary key fingerprint: FB5D B77F D5C1 18B8 0511  ADA8 A631 0ACC 4672 475C

The usual GPG trust warning means the key is not certified by your local web of trust. It does not mean the signature failed; the important parts are the good signature line and the expected AWS CLI fingerprint.

Extract and Run the Installer

Extract the archive and install AWS CLI into the default AWS paths:

unzip -q awscliv2.zip
sudo ./aws/install

The installer creates /usr/local/aws-cli and symlinks aws plus aws_completer into /usr/local/bin. A successful install prints:

You can now run: /usr/local/bin/aws --version

Remove the temporary archive, signature, imported key file, and extracted installer directory after installation:

rm -rf awscliv2.zip awscliv2.sig awscliv2-public-key.asc aws/

Verify the Official Installer

Confirm the command resolves through /usr/local/bin and reports an exe/ build:

command -v aws
aws --version
readlink /usr/local/bin/aws

Relevant output includes:

/usr/local/bin/aws
aws-cli/2.34.45 Python/3.14.4 Linux/7.0.3-arch1-2 exe/x86_64.arch
/usr/local/aws-cli/v2/current/bin/aws

The version changes as AWS publishes new installers. The exe/ marker distinguishes the AWS pre-built installer from the Arch source/ package build.

Method 3: Install AWS CLI via AUR

The aws-cli-bin AUR package wraps AWS’s pre-built v2 zip in a pacman package. Current AUR metadata lists x86_64 and aarch64 sources, SHA-256 checksums for the AWS zip files, less as a runtime dependency, unzip as a build dependency, and conflicts with aws-cli, aws-cli-v2, aws-cli-v2-bin, and aws-cli-git.

aws-cli-bin is community-maintained, not an official Arch Linux or AWS package. Review the PKGBUILD before installing. If you do not already use an AUR helper, install base-devel and Git on Arch Linux, then follow the Arch Wiki AUR workflow or a same-distro helper guide for yay on Arch Linux or paru on Arch Linux.

sudo pacman -S --needed base-devel git

Install the AUR package with your preferred helper:

Using yay:

yay -S aws-cli-bin

Using paru:

paru -S aws-cli-bin

The AUR package installs AWS’s binary payload under a package-owned /usr/local/aws-cli/v2 tree and creates /usr/bin/aws and /usr/bin/aws_completer symlinks. Verify the path and package owner after installation:

command -v aws
aws --version
pacman -Qo "$(command -v aws)"

The command path should be /usr/bin/aws, and the package-owner check should identify aws-cli-bin. The exe/ marker in aws --version indicates the AWS pre-built binary that the AUR recipe packages.

Configure AWS CLI on Arch Linux

AWS CLI needs credentials and default settings before it can call AWS APIs. The default profile stores region and output settings in ~/.aws/config and access keys in ~/.aws/credentials.

Quick Configuration

Start the interactive configuration wizard:

aws configure

Enter your AWS access key ID, secret access key, default region, and output format when prompted. Do not paste example keys from tutorials into a real account. Valid output formats include json, yaml, yaml-stream, text, and table.

Create access keys from the AWS Console under IAM user security credentials, and grant only the permissions that account actually needs. Never commit keys to version control, paste them into shell commands, or share them in screenshots.

Verify Configuration

Check which profile data AWS CLI will use:

aws configure list

Relevant fields include the credential source, region, and profile name:

      Name                    Value             Type    Location
      ----                    -----             ----    --------
   profile                <not set>             None    None
access_key     ****************ABCD shared-credentials-file
secret_key     ****************WXYZ shared-credentials-file
    region                us-east-1      config-file    ~/.aws/config

Then test authentication by querying the identity attached to the active credentials:

aws sts get-caller-identity

Account-specific output includes redacted values like these:

{
    "UserId": "[redacted]",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/example-user"
}

A valid JSON response confirms that AWS CLI can authenticate. If credentials are missing, AWS CLI reports Unable to locate credentials. You can configure credentials by running "aws configure".

Use Multiple Profiles

Create a named profile when you manage separate AWS accounts, roles, or environments:

aws configure --profile production

Run a command with that profile:

aws s3 ls --profile production

Commands without --profile use the default profile. For a temporary shell session, export AWS_PROFILE=production before running AWS CLI commands.

Reset AWS CLI Configuration

Run aws configure again to overwrite the default profile in place. To reset the local files completely, back up the existing directory first:

if [ -d ~/.aws ]; then
  cp -a ~/.aws ~/.aws-backup
else
  echo "No ~/.aws directory to back up"
fi

Remove the default AWS CLI configuration files only when you are sure no profile in that directory is still needed:

rm -f ~/.aws/config ~/.aws/credentials

This does not delete AWS resources or IAM users. It only removes local CLI configuration, so the next aws configure run starts from an empty local profile.

Common AWS CLI Commands on Arch Linux

AWS CLI syntax is the same across the pacman, official installer, and AUR methods once the aws command and credentials are configured. See the AWS CLI Command Reference for service-specific options.

S3 Operations

List S3 buckets in the active account:

aws s3 ls

Upload a file to a bucket:

aws s3 cp localfile.txt s3://bucket-name/

Sync a local directory to S3, uploading only changed files:

aws s3 sync ./local-directory s3://bucket-name/remote-directory

EC2 and IAM Checks

List EC2 instances in the default region:

aws ec2 describe-instances

Filter for running instances and display the response as a table:

aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" --output table

List IAM users:

aws iam list-users

Commands such as aws ec2 stop-instances, aws iam create-user, and aws iam attach-user-policy change real AWS resources. Confirm the active profile and region before running write operations.

The AWS CLI GitHub repository contains release notes and the changelog for v1 and v2.

Update AWS CLI on Arch Linux

Update AWS CLI with the same owner that installed it. Mixing package owners is the most common reason aws --version reports a different build than expected.

Update Pacman Installation

Update AWS CLI with the rest of the Arch system:

sudo pacman -Syu

If you want to reinstall or switch to the v2 package, keep the full system upgrade in the same pacman transaction:

sudo pacman -Syu aws-cli-v2

Avoid partial upgrades on Arch. Updating only one package against stale system libraries can create dependency mismatches.

Upgrade from AWS CLI v1 to v2

Remove the legacy v1 package before installing the v2 package:

sudo pacman -Rns aws-cli
sudo pacman -Syu aws-cli-v2

Then confirm the active command reports a 2. version:

aws --version

Update Official Installer

Download a fresh AWS installer archive and matching signature file. Use the same architecture-specific archive you selected during installation. The upstream installer already handles replacement and no-op detection, so keep this method on the official sequence rather than maintaining a separate local update script:

AWSCLI_ARCHIVE="awscli-exe-linux-x86_64.zip"
curl -fsSL "https://awscli.amazonaws.com/${AWSCLI_ARCHIVE}" -o awscliv2.zip
curl -fsSL "https://awscli.amazonaws.com/${AWSCLI_ARCHIVE}.sig" -o awscliv2.sig

For production or shared systems, verify the signature before extraction. If the AWS CLI key is not already imported, repeat the import step from the signature-verification section first:

gpg --verify awscliv2.sig awscliv2.zip

Extract the fresh archive and run the installer with the same default paths plus --update:

rm -rf aws
unzip -q awscliv2.zip
sudo ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --update

If the downloaded installer matches the installed version, AWS reports a no-op update:

Found same AWS CLI version: /usr/local/aws-cli/v2/2.34.45. Skipping install.

If a newer version is available, the installer replaces the current AWS-managed tree while preserving your ~/.aws/ configuration. Clean up the temporary files after the update:

rm -rf awscliv2.zip awscliv2.sig aws/

Update AUR Installation

Update aws-cli-bin through the same AUR helper that installed it:

Using yay:

yay -Syu aws-cli-bin

Using paru:

paru -Syu aws-cli-bin

Run yay -Syu or paru -Syu without a package name to include AWS CLI in a full AUR and repository upgrade review.

Troubleshoot AWS CLI on Arch Linux

Command Not Found After Installation

First check whether the command exists and which install path should own it:

command -v aws || echo "aws command not in PATH"
pacman -Qo /usr/bin/aws 2>/dev/null || true
readlink /usr/local/bin/aws 2>/dev/null || true

A pacman or AUR install should report /usr/bin/aws. The official installer should report /usr/local/bin/aws and a symlink target under /usr/local/aws-cli/v2/current/bin/aws.

If the official installer symlink is missing, rerun the official installer update command. If the symlink exists but your shell cannot find it, confirm /usr/local/bin is in your PATH:

printf '%s\n' "$PATH"

For Bash users with a custom PATH that omits /usr/local/bin, add a guarded PATH line and reload the shell file:

touch ~/.bashrc
grep -qxF 'export PATH="/usr/local/bin:$PATH"' ~/.bashrc || printf '\nexport PATH="/usr/local/bin:$PATH"\n' >> ~/.bashrc
source ~/.bashrc

Wrong AWS CLI Version Appears

If aws --version shows the wrong branch or build type, check the active binary before reinstalling packages:

command -v aws
aws --version
pacman -Qo "$(command -v aws)" 2>/dev/null || readlink "$(command -v aws)"

A path under /usr/local/bin normally means the official installer is ahead of /usr/bin in PATH. Remove the official installer or adjust PATH if you want the pacman or AUR package to be the active command.

Authentication Errors

If AWS CLI commands fail with credential errors, inspect the active configuration:

aws configure list

Values showing <not set> mean no credentials or region are loaded for the active profile. Re-run aws configure or pass the intended profile explicitly with --profile.

Also verify the local AWS configuration file permissions:

stat -c '%a %n' ~/.aws/config ~/.aws/credentials

600 /home/user/.aws/config
600 /home/user/.aws/credentials

Fix loose permissions on the two AWS CLI files:

chmod 600 ~/.aws/credentials ~/.aws/config

If the files are present and permissions are correct, the key may be inactive, expired, revoked, or missing the service permissions needed for the command.

SSL Certificate Errors

SSL errors usually point to missing CA certificates or an inaccurate system clock. Reinstall the CA bundle first:

sudo pacman -S ca-certificates

Check time synchronization next:

timedatectl status

If NTP is inactive, enable it and retry the AWS CLI command:

sudo timedatectl set-ntp true

Remove AWS CLI from Arch Linux

Remove AWS CLI with the same method that installed it. Package removal does not delete ~/.aws/, because those credentials and profiles are shared by AWS CLI and AWS SDKs.

Remove Pacman Installation

Remove the v2 package and orphaned dependencies:

sudo pacman -Rns aws-cli-v2

If you installed the legacy v1 package instead, remove that package name:

sudo pacman -Rns aws-cli

Verify removal with package state first, then clear shell command caching before checking the command path:

pacman -Q aws-cli-v2 2>/dev/null || echo "aws-cli-v2 removed"
hash -r
command -v aws || echo "aws command removed"

aws-cli-v2 removed
aws command removed

Remove Official Installer

The official installer lives outside pacman, so remove the symlinks and install directory manually. Check the active path first:

command -v aws
readlink /usr/local/bin/aws

The next commands permanently delete the default AWS CLI installer tree under /usr/local. If you used custom --bin-dir or --install-dir paths, substitute those paths instead.

sudo rm -f /usr/local/bin/aws /usr/local/bin/aws_completer
sudo rm -rf /usr/local/aws-cli

Clear the shell cache and verify the command is gone:

hash -r
command -v aws || echo "aws command removed"

aws command removed

Remove AUR Installation

Remove aws-cli-bin through your AUR helper:

Using yay:

yay -Rns aws-cli-bin

Using paru:

paru -Rns aws-cli-bin

Verify that pacman no longer tracks the package and clear command caching:

pacman -Q aws-cli-bin 2>/dev/null || echo "aws-cli-bin removed"
hash -r
command -v aws || echo "aws command removed"

Remove Configuration Files

AWS CLI stores credentials, profiles, and local CLI settings in ~/.aws/. Remove this directory only when you no longer need those profiles and no AWS SDK on the system depends on them.

Back up the directory first:

if [ -d ~/.aws ]; then
  cp -a ~/.aws ~/.aws-backup
else
  echo "No ~/.aws directory to back up"
fi

The next command permanently deletes local AWS credentials, named profiles, and CLI configuration. Skip it if you plan to reinstall AWS CLI or use AWS SDKs with the same profile data.

rm -rf ~/.aws

Conclusion

For most Arch systems, aws-cli-v2 from extra is the best default because pacman owns the package and updates. Use the official installer for AWS’s pre-built binary, and keep aws-cli-bin for AUR-managed workflows after reviewing its PKGBUILD. After installation, configure credentials with aws configure, verify identity with aws sts get-caller-identity, and keep updates tied to the method that created the active aws command.