How to Install AWS CLI on Ubuntu

The AWS Command Line Interface (AWS CLI) is how you manage EC2, S3, IAM, and the rest of AWS from a terminal. On Ubuntu you can install current AWS CLI v2 from Amazon's install script or ZIP bundle, from the aws-cli Snap AWS publishes, or from Ubuntu's awscli APT package. Each method has a different updater and package maintainer.

This guide compares AWS's officially supported install script, ZIP installer, and Snap package with Ubuntu's awscli APT package on Ubuntu 26.04, with real aws --version output from each path tested independently. You will verify the binary, authenticate, and confirm identity with aws sts get-caller-identity.

Before you start

• Install only: aws --version works without an AWS account. Sign-in and API calls need access to an AWS account through console credentials, IAM Identity Center, an EC2 instance role, or another credential provider.
• Install script and ZIP need curl and outbound HTTPS. Minimal images may not ship curl yet.
• User-local installs put the CLI under ~/.local for your Linux account only. System-wide installs put it under /usr/local so every local user can run the same binary.

Quick Answer

AWS recommends its official install script for AWS CLI v2.

If curl is not installed yet:

sudo apt update && sudo apt install -y curl

Install AWS CLI for your current Ubuntu user (no sudo):

curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bash

If aws is not found, put the user-local binary directory on PATH for this shell:

export PATH="$HOME/.local/bin:$PATH"

Open a new terminal after you add that line to ~/.bashrc if you want it in every session. Then verify:

aws --version

For a system-wide installation instead:

curl -fsSL https://awscli.amazonaws.com/v2/install.sh | sudo bash -s -- --system

Ubuntu 26.04 also provides an awscli package through APT, and AWS publishes an official Snap. Ubuntu's APT package and AWS's Snap use different versions and update commands, as explained below.

Does sudo apt install awscli Work on Ubuntu?

It depends on the Ubuntu release. Many readers assume apt install awscli works the same on every LTS—it does not.

On 26.04, inspect the candidate before you install:

apt-cache policy awscli

awscli:
  Installed: (none)
  Candidate: 2.31.35-1
  Version table:
     2.31.35-1 500
        500 http://in.archive.ubuntu.com/ubuntu resolute/universe amd64 Packages

The 2.31.35-1 candidate confirms universe ships v2 on this release. Amazon does not maintain third-party APT repositories; Ubuntu's package is Ubuntu-maintained, not an AWS-supported distribution point like the install script, ZIP, or Snap.

Choose an AWS CLI installation method

The outputs in the install sections below were collected while testing each method independently. Choose one primary installation on your own system—do not install every method unless you are deliberately comparing builds.

For most laptops and servers, use the install script. Use the ZIP when you must verify signatures or install a specific build. Choose Snap if you want automatic updates. Choose APT if you specifically want Ubuntu to manage the package version.

A user-local install serves only your account under ~/.local. A system-wide install under /usr/local is shared by all users on the host.

AWS CLI versions on Ubuntu 26.04, 24.04, and 22.04

The exe/, script-exe/, or update-exe/ segment in aws --version marks Amazon's bundled binary. source/ marks Ubuntu's Python-packaged build.

Install AWS CLI v2 with the AWS install script

Amazon's install script downloads the same bundle as the ZIP installer, picks x86_64 or aarch64 automatically, and can install without root for a single user.

Install for the current user

User-local layout (default):

• CLI files: $HOME/.local/share/aws-cli
• Binary: $HOME/.local/bin/aws

Download and run the script with curl (-fsSL fails on HTTP errors and follows redirects):

curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bash

The script prints the install path and reminds you to put ~/.local/bin on PATH when needed:

You can now run: /home/user/.local/bin/aws --version
AWS CLI 2.38.1 installed to /home/user/.local/share/aws-cli
Ensure /home/user/.local/bin is on your PATH.

Call the binary directly until PATH includes ~/.local/bin:

~/.local/bin/aws --version

aws-cli/2.38.1 Python/3.14.6 Linux/7.0.0-34-generic script-exe/x86_64.ubuntu.26

Install AWS CLI system-wide

System-wide layout matches the ZIP installer:

• Install dir: /usr/local/aws-cli
• Binary: /usr/local/bin/aws

Run the script with --system when you have sudo:

curl -fsSL https://awscli.amazonaws.com/v2/install.sh | sudo bash -s -- --system

After it finishes, verify:

aws --version

aws-cli/2.38.1 Python/3.14.6 Linux/7.0.0-34-generic exe/x86_64.ubuntu.26

Verify the installation

Confirm which binary your shell resolves first:

command -v aws

/usr/local/bin/aws

On a user-local install, command -v aws shows ~/.local/bin/aws only after that directory precedes other copies on PATH. If a new shell still cannot find aws, run export PATH="$HOME/.local/bin:$PATH" before you retry.

Optional: Install AWS CLI v2 with the official ZIP

Use the ZIP when you need GPG signature verification before install or when you want to stage a specific bundle without piping a script. AWS documents verification steps in its install guide (linked in References).

Install curl and unzip if your image is minimal:

Refresh package indexes before you install helpers:

sudo apt update

Install curl and unzip when the ZIP workflow needs them:

sudo apt install -y curl unzip

The install script picks architecture for you; the ZIP does not. Check the machine architecture first:

uname -m

Use awscli-exe-linux-x86_64.zip when the output is x86_64, or awscli-exe-linux-aarch64.zip when it is aarch64.

Download the bundle into /tmp:

cd /tmp

Fetch the official x86_64 zip into the current directory (swap the URL for aarch64 on ARM hosts):

curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip

Extract the bundle and run the installer from the same directory:

unzip -q awscliv2.zip && sudo ./aws/install

The installer prints the path you can call next:

You can now run: /usr/local/bin/aws --version

Confirm the bundled v2 build:

aws --version

aws-cli/2.38.1 Python/3.14.6 Linux/7.0.0-34-generic exe/x86_64.ubuntu.26

Install AWS CLI with Snap

Amazon publishes aws-cli on Snapcraft. Classic confinement avoids sandbox issues with credential files under ~/.aws:

sudo snap install aws-cli --classic

Snap reports the channel and publisher when the install completes:

aws-cli (v2/stable) 2.35.21 from Amazon Web Services (aws**) installed

Your build may show a newer 2.x after automatic refresh. Verify the Snap binary explicitly:

/snap/bin/aws --version

aws-cli/2.35.21 Python/3.14.6 Linux/7.0.0-34-generic exe/x86_64.ubuntu.26

Install AWS CLI from Ubuntu APT

When you want an Ubuntu-managed package and routine apt upgrades, install awscli from universe on releases that ship a candidate (26.04 in this test).

Refresh indexes and install the universe package in one step:

sudo apt update && sudo apt install -y awscli

Call the packaged binary directly so you know which build you are testing:

/usr/bin/aws --version

aws-cli/2.31.35 Python/3.14.4 Linux/7.0.0-34-generic source/x86_64.ubuntu.26

On 26.04 this universe build is 2.31.35, which is below 2.32.0, so it does not include aws login. Use IAM Identity Center (aws configure sso), access keys, an instance profile, or install a newer AWS-managed build if you need aws login.

If you already installed the official bundle, which may still show /usr/local/bin/aws because that path sorts earlier on PATH:

type -a aws

aws is /usr/local/bin/aws
aws is /usr/bin/aws
aws is /bin/aws

On merged /usr Ubuntu systems, /bin/aws may be the same packaged binary as /usr/bin/aws, not a second independent install.

Verify and authenticate AWS CLI on Ubuntu

Check the active AWS binary

Before you configure credentials, confirm the CLI responds:

command -v aws

/usr/local/bin/aws

List every copy when versions disagree:

type -a aws

aws is /usr/local/bin/aws
aws is /usr/bin/aws
aws is /bin/aws
aws is /snap/bin/aws

The sample above shows what appears when each method was tested separately—not a recommended combined setup.

         How will this machine authenticate?
                          |
        +-----------------+------------------+
        |                 |                  |
   Console / IAM      IAM Identity Center     EC2
   aws login          aws configure sso       instance profile
                      aws sso login           (automatic)

Sign in with aws login

On AWS CLI 2.32.0 and newer, aws login uses AWS Management Console sign-in (root, IAM user, or federated IAM) to obtain short-lived credentials. It is not the IAM Identity Center workflow—if your organization uses Identity Center, use the SSO section below instead.

Requires network access to AWS sign-in endpoints. For IAM users, roles, or groups (not the root user), an administrator must allow local development sign-in, typically by attaching the SignInLocalDevelopmentAccess managed policy.

aws login

On a headless server or over SSH with no local browser, use remote sign-in and complete authentication on another device:

aws login --remote

Configure IAM Identity Center

For workforce access through IAM Identity Center (SSO), use a profile backed by SSO:

aws configure sso

Sign in when the CLI prompts you:

aws sso login --profile my-profile

Export AWS_PROFILE=my-profile (or pass --profile) before you run service commands.

Configure access keys when required

Static IAM access keys still work for labs, legacy automation, or environments that require them:

aws configure

You will be prompted for Access Key ID, Secret Access Key, default region, and output format. Files land under ~/.aws/credentials and ~/.aws/config. Prefer short-lived authentication for normal development; AWS discourages long-term IAM user keys for everyday work on real accounts.

List what the CLI sees before any credentials are set:

aws configure list

NAME       : VALUE                    : TYPE             : LOCATION
profile    : <not set>                : None             : None
access_key : <not set>                : None             : None
secret_key : <not set>                : None             : None
region     : <not set>                : None             : None

EC2 instance profiles

If the AWS CLI runs on EC2 with an attached IAM instance profile, you normally do not run aws configure with access keys. The CLI loads temporary role credentials from the instance metadata service automatically.

Verify with STS

Prove the binary and credentials work together:

aws sts get-caller-identity

Without credentials the CLI still runs but cannot call AWS APIs:

aws: [ERROR]: An error occurred (NoCredentials): Unable to locate credentials. You can configure credentials by running "aws login".

Install succeeded—the next step is sign-in, SSO, an instance profile, or keys. For EC2 and S3 walkthroughs after install, continue with the AWS CLI tutorial.

Update AWS CLI on Ubuntu

Update an official AWS installation with aws update

If your AWS-managed install (install script or ZIP) provides the aws update subcommand, use it to refresh the same layout in place. It does not upgrade apt or Snap packages.

User-local install (~/.local/share/aws-cli):

aws update

System-wide install (/usr/local/aws-cli):

sudo aws update

When you already have the current release, the command exits without reinstalling:

Downloading https://awscli.amazonaws.com/v2/install.sh
Running install script...
AWS CLI 2.38.1 is already installed at /usr/local/aws-cli; nothing to do.

Confirm afterward:

aws --version

Older AWS CLI v2 builds that do not list aws update can be refreshed by re-running the install script or ZIP installer with --update.

Fallback: re-download the ZIP and run sudo ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --update when you need an offline bundle.

Update the Snap package

Snap normally refreshes the aws-cli package automatically. To check or apply the latest channel build immediately:

sudo snap refresh aws-cli

Update the Ubuntu APT package

Refresh metadata and upgrade only awscli when a newer universe build exists:

sudo apt update && sudo apt install --only-upgrade awscli

Optional: Enable AWS CLI tab completion

If you use Bash, locate the completer that matches your active install:

command -v aws_completer

Enable completion with the path that command prints (example for a system-wide official install):

echo 'complete -C /usr/local/bin/aws_completer aws' >> ~/.bashrc

Replace /usr/local/bin/aws_completer with ~/.local/bin/aws_completer, /usr/bin/aws_completer, or another path when command -v returns something different.

Uninstall AWS CLI

Remove one method at a time.

Official install script or ZIP (system-wide):

sudo rm -rf /usr/local/aws-cli /usr/local/bin/aws /usr/local/bin/aws_completer

User-local install script:

rm -rf ~/.local/share/aws-cli ~/.local/bin/aws ~/.local/bin/aws_completer

Clear the shell hash table after removal:

hash -r

APT:

sudo apt purge -y awscli

Preview packages apt would remove as unused dependencies:

sudo apt-get -s autoremove

If that list contains only packages you no longer need, remove them:

sudo apt autoremove

Snap:

sudo snap remove aws-cli

Remove ~/.aws only when you no longer need stored profiles. See how to remove software on Ubuntu when you are unsure which package manager installed the CLI.

Troubleshooting

Confirm your release with check Ubuntu version when a step names codenames or archive components.

Summary

On Ubuntu 26.04, the practical default is Amazon's install script: curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bash for your user, or sudo bash -s -- --system for /usr/local/bin/aws. The script handles architecture selection and matches what AWS documents as the recommended Linux path.

Keep the ZIP installer for signature verification or pinned bundles. Snap and apt install awscli use different updaters than aws update; remember 26.04 apt 2.31.35 does not ship aws login. After install, prefer aws login (on 2.32.0+ builds), IAM Identity Center, or an instance role over long-lived keys, then confirm with aws sts get-caller-identity.

When versions disagree, type -a aws shows which copy wins on PATH. Keep one primary installation in scripts, cron jobs, and CI, or call the full binary path explicitly.

References

• Installing or updating the latest version of the AWS CLI — install script, ZIP, and Linux architectures
• Using the AWS CLI update command — aws update for official installs
• Authentication and access credentials for the AWS CLI — aws login, SSO, and credential providers
• Getting started with the AWS CLI — regions and output formats
• AWS CLI version 2 migration guide — v1 to v2
• AWS CLI on GitHub — source and changelog
• aws-cli Snap — Snapcraft listing