1.5.4. AWS CloudShell

First Principle: AWS CloudShell removes the setup step entirely — it is a terminal that is already authenticated as you, so there is no credential file to configure and nothing to install before your first API call.

AWS CloudShell is a browser-based shell you launch directly from the AWS Management Console. The credentials of the console identity you signed in with are already present in the session, so aws commands work immediately — there is no aws configure step and no long-lived access key to store on your machine.

• Pre-authenticated, never privileged: CloudShell runs with the permissions of the signed-in console identity. It grants nothing extra — if your IAM identity cannot call s3:ListBucket, neither can your CloudShell session.
• Pre-installed toolchain: the environment is based on Amazon Linux 2023 and ships with AWS CLI v2, git, pip, vim and runtimes for Python, Node.js and .NET. You can switch between Bash, PowerShell and Z shell in the same session.
• Persistent home directory: up to 1 GB per Region in $HOME survives between sessions at no cost. Anything written outside $HOME belongs to the ephemeral environment and is discarded when the session ends.
• No additional charge: CloudShell itself is free. You pay only for the AWS resources your commands create and for standard data transfer.

Scenario: You need to run a short series of aws lambda update-function-configuration commands against a production account from a borrowed machine you do not want to leave credentials on.

⚠️ Exam Trap: Persistence is per Region and limited to $HOME. A script saved to /tmp, or saved to $HOME while working in a different Region, is gone on your next session. Separately, CloudShell VPC environments have no persistent storage at all — their $HOME is deleted when the environment times out after 20–30 minutes of inactivity, restarts, or is deleted.