AWS vs GCP vs Azure CLI: The Command Reference Every Cloud Engineer Bookmarks

Setting Up: Installation at a Glance

For Linux, all three are available via package manager or as standalone installers. AWS and Azure also have Docker images if you prefer containerised tooling.

Authentication

Getting authenticated is step one — and all three CLIs handle it differently.

# AWS — interactive or SSO
aws configure
# Enter: Access Key ID, Secret Access Key, default region, output format

# Or use SSO:
aws sso login --profile my-profile

# GCP
gcloud auth login
gcloud config set project my-project-id

# For service accounts:
gcloud auth activate-service-account --key-file=key.json

# Azure — browser-based login
az login

# Or with service principal:
az login --service-principal -u APP_ID -p PASSWORD --tenant TENANT_ID

Compute: Managing Virtual Machines and Instances

List running instances / VMs

# AWS — EC2 instances
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,PublicIpAddress]' \
  --output table

# GCP — Compute Engine instances
gcloud compute instances list --filter="status=RUNNING"

# Azure — Virtual Machines
az vm list --show-details \
  --query "[?powerState=='VM running'].[name,location,hardwareProfile.vmSize]" \
  -o table

Start / stop a machine

# AWS
aws ec2 start-instances --instance-ids i-0abcd1234efgh5678
aws ec2 stop-instances --instance-ids i-0abcd1234efgh5678

# GCP
gcloud compute instances start my-instance --zone=us-central1-a
gcloud compute instances stop my-instance --zone=us-central1-a

# Azure
az vm start --resource-group myRG --name myVM
az vm stop --resource-group myRG --name myVM

SSH into an instance

# AWS — EC2 Instance Connect + standard SSH
aws ec2-instance-connect send-ssh-public-key \
  --instance-id i-0abc123 --instance-os-user ec2-user \
  --ssh-public-key file://~/.ssh/id_rsa.pub
ssh -i ~/.ssh/key.pem ec2-user@<public-ip>

# GCP — gcloud wraps SSH for you
gcloud compute ssh my-instance --zone=us-central1-a

# Azure — via Bastion
az network bastion ssh --resource-group myRG --name myBastion \
  --target-resource-id /subscriptions/.../myVM --auth-type ssh-key \
  --username azureuser --ssh-key ~/.ssh/id_rsa

Storage: Buckets and Blob Storage

Three clouds, three names: S3, Cloud Storage, Blob Storage. Same concept, very different commands.

Create a bucket / storage account

# AWS S3
aws s3 mb s3://my-bucket-name --region us-east-1

# GCP Cloud Storage
gcloud storage buckets create gs://my-bucket-name --location=us-central1

# Azure Blob Storage (requires storage account first)
az storage account create --name mystorageacct --resource-group myRG \
  --location eastus --sku Standard_LRS
az storage container create --name mycontainer --account-name mystorageacct

Upload a file

# AWS
aws s3 cp ./myfile.txt s3://my-bucket/myfile.txt

# GCP
gsutil cp ./myfile.txt gs://my-bucket/myfile.txt

# Azure
az storage blob upload --account-name mystorageacct \
  --container-name mycontainer --name myfile.txt --file ./myfile.txt

List bucket contents

# AWS
aws s3 ls s3://my-bucket/ --recursive --human-readable

# GCP
gsutil ls -lh gs://my-bucket/

# Azure
az storage blob list --account-name mystorageacct \
  --container-name mycontainer -o table

IAM: Managing Permissions

IAM is where conceptual models diverge the most. AWS uses policies attached to users/roles. GCP uses bindings at the resource level. Azure uses RBAC with role assignments.

List IAM policies / roles on a resource

# AWS — policies attached to a user
aws iam list-attached-user-policies --user-name john.smith

# GCP — IAM bindings on a project
gcloud projects get-iam-policy my-project-id

# Azure — role assignments in a resource group
az role assignment list --resource-group myRG -o table

Create a service account / access key

# AWS — IAM user and access key
aws iam create-user --user-name ci-deploy
aws iam create-access-key --user-name ci-deploy

# GCP — service account + key file
gcloud iam service-accounts create ci-deploy \
  --display-name "CI Deploy Account"
gcloud iam service-accounts keys create key.json \
  [email protected]

# Azure — service principal
az ad sp create-for-rbac --name ci-deploy \
  --role Contributor --scopes /subscriptions/SUBSCRIPTION_ID

Logs and Monitoring

Debugging starts with logs. Here's how to pull them on each cloud.

# AWS — CloudWatch Logs
aws logs tail /aws/lambda/my-function --follow

# GCP — Cloud Logging
gcloud logging read "resource.type=cloud_function" --limit 50 --format=json

# Azure — App Insights
az monitor app-insights query --app myAppInsights \
  --analytics-query "requests | order by timestamp desc | take 50"

Frequently Asked Questions