AWS administration gets much easier once S3 checks, EC2 inventory, IAM lookups, and deployment scripts can run from a Debian terminal instead of a browser session. To install AWS CLI on Debian Linux, use AWS’s official v2 installer when you want the current upstream CLI on Debian 13, 12, or 11. Snap is also published by Amazon Web Services and handles automatic updates, while Debian’s own awscli package depends on the release.
The Debian package is worth checking, but it is not the same answer everywhere: Debian 13 (Trixie) and Debian 12 (Bookworm) provide AWS CLI v2, while Debian 11 (Bullseye) still provides AWS CLI v1. The pip method also installs v1, so keep it for legacy scripts that specifically depend on v1 behavior.
Install AWS CLI on Debian
Choose one installation method unless you intentionally need separate v1 and v2 environments for migration testing. Each method can expose an aws command, and mixing methods can make updates, PATH precedence, and troubleshooting harder to follow.
| Method | Version Line | Release Coverage | Updates | Best For |
|---|---|---|---|---|
| AWS official installer | AWS CLI v2 | Debian 13, 12, and 11 on Debian amd64 and arm64 | Rerun the installer with --update | Most users, servers, CI/CD hosts, and current AWS CLI v2 workflows |
| Snap package | AWS CLI v2 on v2/stable; v1 channel available | Debian systems with snapd configured | Automatic Snap refresh | Users who want AWS-published packaging with automatic updates |
Debian awscli package | v2 on Debian 13 and 12; v1 on Debian 11 | Debian 13, 12, and 11 from default APT sources | APT upgrades | Package-managed installs where the Debian release version fits the workflow |
| pip virtual environment | AWS CLI v1 | Debian 13, 12, and 11 after python3-venv is installed | Upgrade inside the virtual environment | Legacy scripts that still require AWS CLI v1 |
These commands use
sudofor package installs and writes under/usr/local. If your account cannot run administrative commands yet, set that up first with how to add a user to sudoers on Debian.
Check the Debian awscli Package
Readers often try sudo apt install awscli first. That works from Debian’s default repositories, but the installed major version depends on the Debian release:
| Debian Release | Default awscli Candidate | Practical Guidance |
|---|---|---|
| Debian 13 (Trixie) | 2.23.x from stable | Provides AWS CLI v2 through APT, but the AWS installer and Snap track AWS’s current v2 release more directly. |
| Debian 12 (Bookworm) | 2.9.x from oldstable | Provides AWS CLI v2 through APT, but it is much older than the current AWS v2 installer and Snap release. |
| Debian 11 (Bullseye) | 1.19.x from oldoldstable | Provides AWS CLI v1. Use the AWS installer or Snap if you need v2 on Debian 11. |
If the Debian package is the right fit for your release and workflow, refresh APT metadata and install it:
sudo apt update
sudo apt install awscliVerify the package-managed command:
aws --versionaws-cli/2.x.x Python/3.x.x Linux/6.x.x source/x86_64.debian.13
The source/ segment identifies Debian’s packaged build. On Debian 11, expect a v1-style output with a botocore/ segment instead of the newer v2 output shape.
Install AWS CLI v2 with the Official Installer
The official installer downloads AWS CLI v2 as a bundled Linux build. It avoids Debian’s release-specific package versions and installs under /usr/local/aws-cli, with command symlinks in /usr/local/bin.
Install the download, signature, and extraction tools:
sudo apt update
sudo apt install curl unzip gpg ca-certificates -ySelect the AWS archive that matches the Debian architecture, then download the installer and matching signature. Debian reports amd64 and arm64, while AWS names the archives x86_64 and aarch64. The curl command writes both files to the current directory:
(
set -e
AWS_CLI_DEB_ARCH="$(dpkg --print-architecture)"
case "$AWS_CLI_DEB_ARCH" in
amd64)
AWS_CLI_ARCH="x86_64"
;;
arm64)
AWS_CLI_ARCH="aarch64"
;;
*)
printf 'Unsupported Debian architecture: %s\n' "$AWS_CLI_DEB_ARCH" >&2
exit 1
;;
esac
curl -fL "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_CLI_ARCH}.zip" -o "awscliv2.zip"
curl -fL "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_CLI_ARCH}.zip.sig" -o "awscliv2.sig"
)Save the AWS CLI public key block from AWS’s official installer documentation as aws-cli-public-key.gpg, then import it:
gpg --import aws-cli-public-key.gpggpg: key A6310ACC4672475C: public key "AWS CLI Team <aws-cli@amazon.com>" imported gpg: Total number processed: 1 gpg: imported: 1
Confirm the key fingerprint before trusting the signature. The fingerprint should match FB5D B77F D5C1 18B8 0511 ADA8 A631 0ACC 4672 475C:
gpg --fingerprint A6310ACC4672475CKey fingerprint = FB5D B77F D5C1 18B8 0511 ADA8 A631 0ACC 4672 475C
Verify the signature against the archive. The trust warning is expected when the AWS CLI key is not connected to your personal PGP trust chain, but the signature line and fingerprint must match:
gpg --verify awscliv2.sig awscliv2.zipgpg: Good signature from "AWS CLI Team <aws-cli@amazon.com>" [unknown] Primary key fingerprint: FB5D B77F D5C1 18B8 0511 ADA8 A631 0ACC 4672 475C
Extract the archive with the unzip command, then install AWS CLI v2:
unzip awscliv2.zip
sudo ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cliYou can now run: /usr/local/bin/aws --version
Remove the downloaded installer files after the install succeeds:
rm -rf awscliv2.zip awscliv2.sig aws/Confirm that your shell finds the official installer build:
command -v aws
aws --version/usr/local/bin/aws aws-cli/2.x.x Python/3.x.x Linux/6.x.x exe/x86_64.debian.13
The exact AWS CLI, Python, kernel, and architecture values will change. The exe/ segment identifies the bundled AWS CLI v2 build from the official installer or Snap package.
Install AWS CLI v2 with Snap
The Snap package is published by Amazon Web Services and uses classic confinement. Debian does not install snapd by default, so install and initialize snapd first when snap is missing. For a fuller Snap setup and cleanup workflow, use Install Snapd and Snap Store on Debian.
sudo apt update
sudo apt install snapd -y
sudo systemctl enable --now snapd.socket
sudo snap wait system seed.loaded
sudo snap install snapd
sudo snap wait system seed.loadedVerify that snapd is active:
snap versionsnap 2.x.x snapd 2.x.x series 16 debian 13 kernel 6.x.x architecture amd64
Install the AWS CLI Snap package:
sudo snap install aws-cli --classicaws-cli (v2/stable) 2.x.x from Amazon Web Services (aws**) installed
Current Snap metadata tracks v2/stable for the default install command. The latest/stable and v1/stable channels still expose AWS CLI v1, so use the v1 channel only when you intentionally need legacy behavior.
Verify the Snap app immediately with snap run:
snap run aws-cli.aws --versionaws-cli/2.x.x Python/3.x.x Linux/6.x.x exe/x86_64.debian.13
Open a new login shell if the bare aws shortcut is not available yet. Debian sessions usually need /snap/bin on PATH before snap application aliases work without snap run.
If you specifically need AWS CLI v1 from Snap, install the v1 channel instead:
sudo snap install aws-cli --channel=v1/stable --classicIf AWS CLI is already installed through Snap, switch channels with snap refresh:
sudo snap refresh aws-cli --channel=v1/stableInstall AWS CLI v1 in a Python Virtual Environment
The PyPI awscli package installs AWS CLI v1, not AWS CLI v2. Use this method only when a legacy script or toolchain still depends on v1 behavior. A virtual environment keeps the pip-managed CLI separate from Debian’s system Python packages.
Do not confuse the official awscli package on PyPI with third-party v2 wrapper packages. AWS publishes v2 through the official installer and Snap package, so wrapper packages add another layer between your shell and AWS credentials.
Install virtual environment support:
sudo apt update
sudo apt install python3-venv -yCreate and activate a dedicated environment for AWS CLI v1:
python3 -m venv ~/.aws-cli-v1
source ~/.aws-cli-v1/bin/activateInstall AWS CLI v1 inside that environment:
python -m pip install --upgrade pip
pip install awscliVerify the virtual environment’s binary directly:
~/.aws-cli-v1/bin/aws --versionaws-cli/1.x.x Python/3.x.x Linux/6.x.x botocore/1.x.x
On Debian 11, the default Python 3.9 environment resolves the newest Python 3.9-compatible AWS CLI v1 release instead of the newest PyPI release overall. Prefer the official installer or Snap for AWS CLI v2 on Debian 11.
Add the virtual environment to your shell path only if you want the v1 command available without activating the environment each time. The guard prevents duplicate PATH lines if you rerun it:
path_line="export PATH=\"\$HOME/.aws-cli-v1/bin:\$PATH\""
touch ~/.bashrc
grep -qxF "$path_line" ~/.bashrc || echo "$path_line" >> ~/.bashrc
export PATH="$HOME/.aws-cli-v1/bin:$PATH"Configure AWS CLI on Debian
AWS CLI needs credentials and a default region before it can call AWS services. Access-key configuration is stored in ~/.aws/credentials, while region and output settings are stored in ~/.aws/config.
Configure AWS CLI Access Keys
Start the interactive configuration wizard:
aws configureAWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY Default region name [None]: us-east-1 Default output format [None]: json
Replace the example values with your real AWS access key, secret key, default region, and preferred output format. Valid output formats include json, yaml, yaml-stream, text, and table.
Access keys should use the minimum permissions required for the task. Keep credentials out of shell history, Git repositories, screenshots, and shared terminal transcripts.
Configure AWS CLI IAM Identity Center
If your organization uses AWS IAM Identity Center, configure SSO instead of long-lived access keys:
aws configure ssoAfter the profile exists, authenticate with:
aws sso login --profile productionReplace production with the profile name you created. AWS documents the full configuration file layout in its AWS CLI configuration and credentials guide.
Verify AWS CLI Configuration
List the active configuration values:
aws configure listNAME : VALUE : TYPE : LOCATION profile : <not set> : None : None access_key : <not set> : None : None secret_key : <not set> : None : None region : <not set> : None : None
Values of <not set> mean the current profile is incomplete. After credentials are configured, test the active identity:
aws sts get-caller-identity{
"UserId": "AIDACKCEVSQ6C2EXAMPLE",
"Account": "123456789012",
"Arn": "arn:aws:iam::123456789012:user/username"
}
Your account ID and ARN will be different. This command confirms that AWS CLI can sign requests and reach AWS with the active credentials.
Create Multiple AWS CLI Profiles
Use named profiles when you work with multiple AWS accounts, roles, or regions:
aws configure --profile productionRun commands against that profile with --profile:
aws sts get-caller-identity --profile productionUse AWS CLI on Debian
After installation and configuration, AWS CLI commands use the same service syntax across the official installer, Snap, Debian package, and pip v1 methods. Start with read-only checks before running commands that create, modify, or delete cloud resources.
List S3 Buckets with AWS CLI
aws s3 lsWith valid credentials, the command prints bucket names or no output if the account has no visible buckets.
Copy and Sync Files to S3 with AWS CLI
Copy and sync operations upload data to S3, so test with a non-production bucket or a temporary prefix before using production paths.
aws s3 cp localfile.txt s3://bucket-name/
aws s3 sync ./local-directory s3://bucket-name/remote-directoryReplace bucket-name and paths with your own storage locations. The sync command uploads changed files only, which makes it useful for backup scripts and static-site deployment workflows.
Inspect EC2 Instances with AWS CLI
aws ec2 describe-instances
aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" --output tableThe first command returns detailed JSON. The second command limits results to running instances and formats the response as a table.
List IAM Users with AWS CLI
aws iam list-usersThe IAM example needs permissions to list users in the target account. For the full service syntax, use the AWS CLI Command Reference.
Update AWS CLI on Debian
Update AWS CLI with the same manager you used for installation. Before troubleshooting an old version, confirm the active binary with command -v aws and aws --version.
Update the AWS Official Installer Method
Use the same architecture selection during updates so Debian arm64 systems download the AWS aarch64 archive instead of the x86_64 archive:
(
set -e
rm -rf awscliv2.zip awscliv2.sig aws/
AWS_CLI_DEB_ARCH="$(dpkg --print-architecture)"
case "$AWS_CLI_DEB_ARCH" in
amd64)
AWS_CLI_ARCH="x86_64"
;;
arm64)
AWS_CLI_ARCH="aarch64"
;;
*)
printf 'Unsupported Debian architecture: %s\n' "$AWS_CLI_DEB_ARCH" >&2
exit 1
;;
esac
curl -fL "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_CLI_ARCH}.zip" -o "awscliv2.zip"
curl -fL "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_CLI_ARCH}.zip.sig" -o "awscliv2.sig"
gpg --verify awscliv2.sig awscliv2.zip
unzip awscliv2.zip
sudo ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --update
rm -rf awscliv2.zip awscliv2.sig aws/
aws --version
)A no-op update can print a skip message when the installed version already matches the downloaded archive:
Found same AWS CLI version: /usr/local/aws-cli/v2/2.x.x. Skipping install.
If AWS has published a newer version, the installer updates the existing files instead of printing the skip message.
Update the AWS CLI Snap Package
sudo snap refresh aws-cli
snap list aws-cliSnap also refreshes packages automatically in the background, so the manual refresh command is mostly useful when you want to check immediately.
Update the Debian awscli Package
sudo apt update
sudo apt install --only-upgrade awscliThis keeps the Debian package on the version available from your configured Debian sources. It does not switch Debian 11 from v1 to v2.
Update the pip AWS CLI v1 Method
~/.aws-cli-v1/bin/pip install --upgrade awscli
~/.aws-cli-v1/bin/aws --versionOn Debian 11, pip may stay on the newest AWS CLI v1 release compatible with Python 3.9 rather than the newest PyPI release overall.
Troubleshoot AWS CLI on Debian
Fix aws Command Not Found
First, check which aws command your shell can see:
command -v aws/usr/local/bin/aws
For the official installer, confirm the symlink points to the current AWS CLI v2 directory:
ls -l /usr/local/bin/awslrwxrwxrwx 1 root root 37 May 27 14:30 /usr/local/bin/aws -> /usr/local/aws-cli/v2/current/bin/aws
If the symlink is missing, rerun the official installer with the same --bin-dir and --install-dir paths. For Snap installs, use snap run aws-cli.aws --version immediately or open a new login shell so /snap/bin appears on PATH. For pip v1 installs, run ~/.aws-cli-v1/bin/aws --version directly or add the virtual environment path to your shell profile.
Fix the Wrong AWS CLI Version on Debian
Check both the binary path and version details before replacing anything:
command -v aws
aws --versionAn output path of /usr/bin/aws usually means the Debian package owns the command. A v1 output on Debian 11 is expected from the Debian package; install AWS CLI v2 with the official installer or Snap if your workflow requires v2.
Fix Snap aws Alias Not Found
Fresh Debian SSH shells and older desktop sessions may not see /snap/bin immediately after snapd setup. Check the current PATH:
echo "$PATH" | tr ':' '\n' | grep '^/snap/bin$'/snap/bin
If the command prints nothing, log out and back in, then recheck. Until the session PATH refreshes, use:
snap run aws-cli.aws --versionFix python3 venv ensurepip Errors
If python3 -m venv reports that ensurepip is unavailable, install the venv package and recreate the environment:
sudo apt install python3-venv -y
rm -rf ~/.aws-cli-v1
python3 -m venv ~/.aws-cli-v1Fix AWS CLI Unable to Locate Credentials
Credential errors usually mean the active profile has no usable access key, SSO session, role source, or instance metadata credential. Start with the local profile list:
aws configure listRun aws configure for access keys, or use aws configure sso and aws sso login for IAM Identity Center profiles. Then rerun aws sts get-caller-identity to confirm the profile works.
Fix AWS CLI SSL Certificate Errors
Certificate failures usually point to missing CA certificates, a TLS-intercepting proxy, or an incorrect system clock. Refresh Debian’s CA package first:
sudo apt install ca-certificates -y
sudo update-ca-certificatesUpdating certificates in /etc/ssl/certs... 0 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d...
Then check time synchronization:
timedatectl status
sudo timedatectl set-ntp trueRemove AWS CLI from Debian
Use the removal path that matches your installation method. AWS CLI credentials and profiles live under ~/.aws/ and are not removed by package, Snap, installer, or virtual environment cleanup unless you delete them separately.
Remove the AWS Official Installer Method
This removes the AWS CLI symlinks and the installer-managed directory under
/usr/local. Verify the paths before running the commands if you customized--bin-diror--install-dir.
sudo rm -f /usr/local/bin/aws /usr/local/bin/aws_completer
sudo rm -rf /usr/local/aws-cli
hash -r
command -v aws || echo "aws removed"aws removed
Remove the AWS CLI Snap Package
sudo snap remove --purge aws-cli
hash -r
command -v aws || echo "aws removed"aws-cli removed aws removed
If AWS CLI was your only snap and you also want to remove snapd, remove application snaps first, then purge snapd and clean leftover snap paths:
sudo apt purge snapd
if findmnt -R /snap >/dev/null; then
echo "Active snap mounts remain; reboot before deleting snap paths."
else
sudo rm -rf /snap /var/snap /var/lib/snapd /var/cache/snapd
rm -rf "$HOME/snap"
fi
hash -r
command -v snap || echo "snap removed"The snapd cleanup removes snap application data, snapshots, and user settings under
$HOME/snap. Keep snapd if you use other snap applications.
Remove the Debian awscli Package
If you installed Debian’s package, remove it with APT:
sudo apt remove awscliReview optional dependency cleanup separately before confirming removals:
sudo apt autoremove --dry-runRemove the pip AWS CLI v1 Virtual Environment
This deletes the dedicated AWS CLI v1 virtual environment. Do not run it if you reused the same environment for other Python tools.
rm -rf ~/.aws-cli-v1If ~/.bashrc contains the dedicated AWS CLI v1 PATH line, remove that exact line:
if [ -f ~/.bashrc ]; then
path_line="export PATH=\"\$HOME/.aws-cli-v1/bin:\$PATH\""
grep -vxF "$path_line" ~/.bashrc > ~/.bashrc.tmp
mv ~/.bashrc.tmp ~/.bashrc
fi
hash -rRemove AWS CLI Configuration Files
Delete ~/.aws/ only if you no longer need saved profiles, regions, SSO settings, or credentials.
if [ -d ~/.aws ]; then
cp -r ~/.aws ~/.aws-backup
fiThis permanently deletes AWS CLI configuration and credential files for your user account. Keep the backup until you confirm you no longer need those profiles.
rm -rf ~/.awsConclusion
AWS CLI on Debian is cleanest when the install source matches the job: the AWS installer for current v2 everywhere, Snap for AWS-published automatic updates, Debian’s package where the release version fits, and pip virtual environments for v1-only scripts. Keep ~/.aws/ protected because it controls how the CLI signs requests against your AWS accounts.
Formatting tips for your comment
You can use basic HTML to format your comment. Useful tags currently allowed in published comments:
<code>command</code>command<strong>bold</strong><em>italic</em><blockquote>quote</blockquote>