1
aws cloudwatch put-metric-data \
2
  --namespace "MyApp" \
3
  --metric-name "ActiveUsers" \
4
  --dimensions Environment=prod \
5
  --value 42 \
6
  --unit Count

1
# Find the top 10 slowest requests in an API log group
2
fields @timestamp, @message, duration
3
| filter @message like /Request/
4
| sort duration desc
5
| limit 10

1
# Run an SSM Automation runbook from the CLI
2
aws ssm start-automation-execution \
3
  --document-name "AWS-RestartEC2Instance" \
4
  --parameters "InstanceId=i-0abc1234"

1
# Target tracking policy on a custom CloudWatch metric
2
aws autoscaling put-scaling-policy \
3
  --auto-scaling-group-name my-asg \
4
  --policy-name keep-cpu-50 \
5
  --policy-type TargetTrackingScaling \
6
  --target-tracking-configuration file://config.json

1
aws cloudformation detect-stack-drift --stack-name my-stack
2
aws cloudformation describe-stack-resource-drifts --stack-name my-stack

1
// TypeScript CDK: an S3 bucket with versioning enabled
2
import { Stack, StackProps } from 'aws-cdk-lib';
3
import { Bucket } from 'aws-cdk-lib/aws-s3';
4

5
export class MyStack extends Stack {
6
  constructor(scope: any, id: string, props?: StackProps) {
7
    super(scope, id, props);
8
    new Bucket(this, 'Data', { versioned: true });
9
  }
10
}

1
# Store and retrieve a secret string parameter
2
aws ssm put-parameter --name "/app/db/url" \
3
  --value "postgres://..." --type SecureString
4
aws ssm get-parameter --name "/app/db/url" --with-decryption

1
// Deny launching EC2 outside specific regions
2
{
3
  "Version": "2012-10-17",
4
  "Statement": [{
5
    "Effect": "Deny",
6
    "Action": "ec2:RunInstances",
7
    "Resource": "*",
8
    "Condition": {
9
      "StringNotEquals": {
10
        "aws:RequestedRegion": ["us-east-1", "eu-west-1"]
11
      }
12
    }
13
  }]
14
}

1
# High-level CLI sketch
2
aws s3api put-bucket-policy --bucket my-site --policy file://oac-policy.json
3
aws cloudfront create-distribution --distribution-config file://dist.json
4
aws route53 change-resource-record-sets \
5
  --hosted-zone-id Z123 --change-batch file://alias.json

1
aws ec2 create-flow-logs \
2
  --resource-type VPC \
3
  --resource-ids vpc-0abc1234 \
4
  --traffic-type ALL \
5
  --log-destination-type cloud-watch-logs \
6
  --log-group-name /vpc/flowlogs \
7
  --deliver-logs-permission-arn arn:aws:iam::111122223333:role/flowlogs-role

1
# Programmatic access via the Cost Explorer API
2
aws ce get-cost-and-usage \
3
  --time-period Start=2026-05-01,End=2026-05-28 \
4
  --granularity DAILY \
5
  --metrics "UnblendedCost" \
6
  --group-by Type=DIMENSION,Key=SERVICE