Set up your computer

Both of Priya’s problems have simple fixes: install everything the same way, and know exactly where your AWS credentials come from.

You need a handful of tools. Almost all of them install the same way, with Homebrew, a package manager that runs on macOS and Linux. You ask for a tool by name, and Homebrew downloads it, installs it and keeps it up to date.

On Windows, you’ll use WSL 2, a real Ubuntu Linux built into Windows, and install Homebrew inside it. That way every command in this course works the same on macOS, Windows and Linux, and matches what runs on the Linux servers you’ll build.

What you’re installing, and why

How the AWS CLI knows who you are

Every AWS command has to prove who’s asking. The CLI finds credentials by looking in several places, in a fixed order, and uses the first one it finds. It never looks further.

A profile is a named set of settings in ~/.aws/config: which account, which role, which region. The ~ means your home folder. You’ll make one profile, called quickcart, that signs in through IAM Identity Center. Its credentials expire after a few hours, so there’s nothing long-lived on your laptop to leak.

There’s a longer list in the AWS documentation, with things that only matter on servers. These four are the ones that trip people up on a laptop.

Your laptop has the quickcart profile set up. Turn the other sources on and off, and see which one the CLI uses, and what aws sts get-caller-identity would print.

$ aws sts get-caller-identity
{
    "UserId": "AROA3EXAMPLEEXAMPLE1:maya",
    "Account": "111122223333",
    "Arn": "arn:aws:sts::111122223333:assumed-role/AWSReservedSSO_AdministratorAccess_1a2b3c4d5e6f7a8b/maya"
}

What to notice: turning on the old keys doesn’t cause an error. The output looks perfectly normal. Only the Account line gives it away. That’s why checking who you are is a habit, not a one-off.

Free — installing tools and signing in cost nothing.

You’ll install every tool the course uses, sign in to AWS through IAM Identity Center, and check who you are. About 30 minutes, most of it waiting for downloads.

You need the admin user and access portal from How this course works. The first two steps are different on macOS, Windows and Linux. From step 3 on, every command is the same on all three, and so is every command in the rest of the course.

1. Open a terminal that works like everyone else's

   This course’s commands are written for a Unix-style terminal, the kind every Mac and Linux machine has. Windows gets one too, through WSL 2.

   Your system	Do this
   macOS	Open the Terminal app (search for it with Spotlight). Then install Apple’s command line tools, below
   Windows 10 or 11	Install WSL 2 with Ubuntu, below. From then on, always use the Ubuntu terminal for this course
   Linux (Ubuntu or Debian)	Open your Terminal app. There’s nothing to add in this step

   On macOS: Apple’s command line tools

   TerminalCopy

   xcode-select --install

   Part	What it means
   xcode-select	Apple’s tool for managing developer tools
   --install	install the command line developer tools, without the whole of Xcode

   A window opens. Choose Install and agree to the licence. If you already have the tools, the terminal says so, and you can go straight on:

   You should see

   xcode-select: note: Command line tools are already installed.

   On Windows: WSL 2 with Ubuntu

   WSL, the Windows Subsystem for Linux, runs a real Ubuntu Linux inside Windows. Open PowerShell as administrator: right-click the Start button, then choose Terminal (Admin) or Windows PowerShell (Admin). Then run:

   TerminalCopy

   wsl --install

   Part	What it means
   wsl	the Windows Subsystem for Linux command
   --install	turn on WSL 2 and install Ubuntu, the default Linux

   Restart Windows when it asks. Afterwards, open Ubuntu from the Start menu. The first time, it asks you to choose a Linux user name and password. They are separate from your Windows login; remember the password, because sudo asks for it.

   You should see

   A terminal window with a prompt like you@DESKTOP-1A2B3C:~$. Everything else in this course happens in this Ubuntu window, not in PowerShell.

2. Install Homebrew

   Homebrew installs every other tool in this course, the same way on macOS and on Linux, including the Ubuntu inside WSL.

   On macOS

   Homebrew’s website, brew.sh, links to its latest release on GitHub. Download the file ending in .pkg, double-click it and follow the installer. Then open a new terminal window, so it picks up the new tool.

   On Linux and Windows (inside Ubuntu)

   First, install the few things Homebrew needs to build and download software:

   TerminalCopy

   sudo apt-get update

   Part	What it means
   sudo	run the next command as the administrator. It asks for your Linux password
   apt-get update	refresh Ubuntu’s list of available packages

   TerminalCopy

   sudo apt-get install -y build-essential procps curl file git

   Part	What it means
   sudo apt-get install	install packages from Ubuntu, as the administrator
   -y	answer yes to “Do you want to continue?”
   build-essential procps curl file git	compilers, process tools, a downloader, a file-type checker and git: what Homebrew needs

   Download Homebrew’s installer to a file, so you can see what you’re running:

   TerminalCopy

   curl -fsSL -o install-homebrew.sh https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh

   Part	What it means
   curl	download from a web address
   -fsSL	fail on errors, stay quiet, and follow redirects
   -o install-homebrew.sh	save it to this file instead of printing it
   https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh	Homebrew’s official installer

   Run it:

   TerminalCopy

   bash install-homebrew.sh

   Part	What it means
   bash	run a script
   install-homebrew.sh	the installer you just downloaded

   It asks for your password and for Enter to continue, then takes a few minutes. Near the end it says:

   You should see

   ==> Installation successful!

   Homebrew on Linux lives in /home/linuxbrew/.linuxbrew. Tell your terminal to look there for commands, in the settings file it reads every time it opens:

   TerminalCopy

   echo 'export PATH="/home/linuxbrew/.linuxbrew/bin:$PATH"' >> ~/.bashrc

   Part	What it means
   echo '…'	print the text between the single quotes, exactly as written
   export PATH="/home/linuxbrew/.linuxbrew/bin:$PATH"	the line being added: put Homebrew’s folder at the front of the list of places to find commands
   >>	add the printed text to the end of a file, instead of showing it. One > would replace the whole file
   ~/.bashrc	the settings file your terminal reads when it opens. ~ is your home folder

   Then open a new terminal window.

   Everyone: check it works

   TerminalCopy

   brew --version

   Part	What it means
   brew	Homebrew’s command
   --version	print which version is installed

   You should see

   Homebrew 7.0.6

   Yours may be newer.

3. Install git and tell it who you are

   TerminalCopy

   brew install git

   Part	What it means
   brew install	download and install a tool
   git	the tool’s name in Homebrew

   Your system may already have a git, but Homebrew’s is newer and stays up to date. Open a new terminal window, then check:

   TerminalCopy

   git --version

   Part	What it means
   git --version	print which version of git runs when you type git

   You should see

   git version 2.51.0

   Yours may be newer. Now tell git your name and email, which it records with every change you save. Put your own in place of the highlighted values:

   TerminalCopy

   git config --global user.name "Your Name"

   Part	What it means
   git config	change a git setting
   --global	for every project on this computer, not just one
   user.name	the setting: your name as it appears in history
   "Your Name"	replace with your name. The quotes keep the space in it

   TerminalCopy

   git config --global user.email "you@example.com"

   Part	What it means
   user.email	the setting: the email recorded with your changes
   "you@example.com"	replace with your email

4. Install the AWS CLI

   TerminalCopy

   brew install awscli

   Part	What it means
   brew install	download and install a tool
   awscli	the AWS command line tool, version 2

   TerminalCopy

   aws --version

   Part	What it means
   aws --version	print which version of the AWS CLI is installed

   You should see

   aws-cli/2.37.3 Python/3.13.7 Linux/6.6.87 source/x86_64

   Your numbers will differ, and the middle names your system: Darwin on a Mac, Linux on Linux and WSL. What matters is that it starts with aws-cli/2. Version 1 is old and works differently.

5. Install Docker

   Docker builds and runs containers. How you install it depends on your system:

   Your system	Install
   macOS	Run brew install --cask docker-desktop. Then open Docker from Applications, accept the terms and choose Use recommended settings
   Windows	Download Docker Desktop for Windows from docker.com and install it with the WSL 2 option. Open it, then go to Settings → Resources → WSL integration and turn it on for Ubuntu. The docker command then works inside your Ubuntu terminal
   Linux	Install the Docker engine and give yourself permission to use it, with the two commands below

   On Linux only

   TerminalCopy

   sudo apt-get install -y docker.io

   Part	What it means
   sudo apt-get install -y	install a package from Ubuntu, answering yes
   docker.io	Ubuntu’s package of the Docker engine and the docker command

   TerminalCopy

   sudo usermod -aG docker "$USER"

   Part	What it means
   sudo usermod	change a user account, as the administrator
   -aG docker	add them to the Group called docker, which may use the Docker engine
   "$USER"	your own user name, which the terminal fills in

   Log out and back in, so the new group applies. Docker’s own documentation also describes installing its newest release from Docker’s package repository, if you need a newer version than Ubuntu’s.

   Everyone: run a tiny test container

   TerminalCopy

   docker run --rm hello-world

   Part	What it means
   docker run	start a container from an image, downloading the image first if needed
   --rm	delete the container when it finishes, so nothing is left behind
   hello-world	a tiny image that prints a message and exits

   You should see

   Hello from Docker!
   This message shows that your installation appears to be working correctly.

   More lines follow, explaining what just happened.

6. Install Terraform

   Terraform comes from HashiCorp’s own collection of Homebrew packages, called a tap. First, add the tap:

   TerminalCopy

   brew tap hashicorp/tap

   Part	What it means
   brew tap	add another collection of packages to Homebrew
   hashicorp/tap	HashiCorp’s collection

   Then install from it:

   TerminalCopy

   brew install hashicorp/tap/terraform

   Part	What it means
   brew install	download and install
   hashicorp/tap/terraform	Terraform, from HashiCorp’s tap specifically

   TerminalCopy

   terraform version

   Part	What it means
   terraform version	print which version of Terraform is installed

   You should see

   Terraform v1.16.4
   on linux_amd64

   Yours may be newer. The second line names your system: darwin_arm64 on a Mac with an Apple chip, linux_amd64 on most Linux and Windows computers.

7. Install kubectl and a code editor

   TerminalCopy

   brew install kubectl

   Part	What it means
   brew install	download and install
   kubectl	the command line tool for Kubernetes

   TerminalCopy

   kubectl version --client

   Part	What it means
   kubectl version	print version information
   --client	only for this tool on your computer. Without it, kubectl also tries to contact a cluster, and you don’t have one yet

   You should see

   Client Version: v1.37.1

   A second line gives the version of Kustomize, a tool built into kubectl. Your versions will differ.

   If you don’t already have a code editor you like, install Visual Studio Code from its website: it’s free on macOS, Windows and Linux. On Windows, also install its WSL extension, so it can open and edit the files inside Ubuntu: from the Ubuntu terminal, code . then opens the current folder.

8. Connect the AWS CLI to your admin user

   Find your AWS access portal URL first: it’s in IAM Identity Center → Dashboard → Settings summary, and ends in awsapps.com/start. Then:

   TerminalCopy

   aws configure sso

   Part	What it means
   aws configure	set up how the CLI connects to AWS
   sso	through IAM Identity Center, which used to be called AWS SSO

   It asks a series of questions. Answer them like this:

   It asks	Enter
   SSO session name (Recommended)	quickcart
   SSO start URL	Your AWS access portal URL
   SSO region	us-east-1
   SSO registration scopes	Press Enter to accept the default

   Your browser opens. Sign in as your admin user if asked, with your MFA, and choose Allow access. If no browser opens — which can happen inside WSL — the terminal shows a web address and a code: open the address in your browser and enter the code. Back in the terminal, it finds your account and role, then asks three more questions:

   It asks	Enter
   Default client Region	us-east-1
   CLI default output format	json
   Profile name	quickcart

   It finishes with

   To use this profile, specify the profile name using --profile, as shown:
   
   aws sts get-caller-identity --profile quickcart

   The wording may differ slightly between versions. Everything you entered is saved in ~/.aws/config. It looks like this, with your own portal address in place of the highlighted value. There are no keys in it.

   ~/.aws/configCopy

   [profile quickcart]
   sso_session = quickcart
   sso_account_id = 111122223333
   sso_role_name = AdministratorAccess
   region = us-east-1
   output = json
   
   [sso-session quickcart]
   sso_start_url = START_URL
   sso_region = us-east-1
   sso_registration_scopes = sso:account:access

   Setting	What it means
   [profile quickcart]	the start of a profile named quickcart
   sso_session	which sign-in session this profile uses
   sso_account_id	your 12-digit account ID
   sso_role_name	the permission set you were given
   region and output	where commands run, and how results are printed
   [sso-session quickcart]	how to sign in: your portal address and its region

9. Check who you are

   TerminalCopy

   aws sts get-caller-identity --profile quickcart

   Part	What it means
   aws sts	the Security Token Service, which deals with identities
   get-caller-identity	say who is making this request. It needs no permissions, so it always works when credentials are valid
   --profile quickcart	use the quickcart profile

   You should see

   {
       "UserId": "AROA3EXAMPLEEXAMPLE1:maya",
       "Account": "111122223333",
       "Arn": "arn:aws:sts::111122223333:assumed-role/AWSReservedSSO_AdministratorAccess_1a2b3c4d5e6f7a8b/maya"
   }

   Your account number, ID and name will be yours. Check two things: Account is your account, and the Arn contains AWSReservedSSO_AdministratorAccess, which means you’re signed in through Identity Center, not with keys.

10. Make quickcart the profile for this terminal

    Typing --profile quickcart every time is tiring. Set it once for the terminal window:

    TerminalCopy

    export AWS_PROFILE=quickcart

    Part	What it means
    export	set a variable for this terminal window and every command started from it
    AWS_PROFILE=quickcart	tell the AWS CLI, Terraform and other tools to use the quickcart profile

    Now ask the CLI where each of its settings comes from:

    TerminalCopy

    aws configure list

    Part	What it means
    aws configure list	show the profile, keys and region in use, and where each one came from

    You should see

          Name                    Value             Type    Location
          ----                    -----             ----    --------
       profile                quickcart              env    ['AWS_PROFILE', 'AWS_DEFAULT_PROFILE']
    access_key     ****************ABCD              sso
    secret_key     ****************WXYZ              sso
        region                us-east-1      config-file    ~/.aws/config

    The layout may differ slightly. The Type column is the useful part: sso means the keys came from your Identity Center sign-in. If it says env, keys in environment variables are winning.

    To have it in every new terminal window, add the same line to your terminal’s settings file: ~/.bashrc on Linux and WSL, ~/.zprofile on macOS. On Linux and WSL:

    TerminalCopy

    echo 'export AWS_PROFILE=quickcart' >> ~/.bashrc

    Part	What it means
    echo '…' >>	add this line to the end of a file
    export AWS_PROFILE=quickcart	the line: use the quickcart profile
    ~/.bashrc	the settings file. On macOS, use ~/.zprofile instead

11. Clean-up step: Clean up

    Nothing here costs money. Keep every tool: the rest of the course uses them. You can delete the install-homebrew.sh file if you downloaded it.

    When you finish a session, sign out so the credentials on your computer stop working straight away, instead of when they expire:

    TerminalCopy

    aws sso logout

    Part	What it means
    aws sso logout	delete the cached sign-in from this computer. The next command will need aws sso login

    It prints nothing when it works. On macOS and Windows you can also quit Docker Desktop when you aren’t using it, to save memory and battery.