AWS S3 Command Generator

Build aws s3 Commands Without Memorising the Flags

The AWS S3 Command Generator turns a handful of checkboxes into a correct, copy-ready aws s3 command. Pick the operation you want — sync, cp, mv, rm, or ls — set your source and destination, tick the flags that apply, and the command assembles itself live at the bottom of the page. Nothing is sent anywhere: the builder runs entirely in your browser, so bucket names, profile names, and KMS key IDs never leave your machine.

It exists because the S3 CLI is deceptively easy to get wrong. aws s3 sync and aws s3 cp take overlapping but not identical flag sets, --delete only means something on sync, filter ordering changes the result completely, and a single misplaced argument can quietly delete objects on the destination side. This tool is aimed at anyone who runs S3 operations occasionally enough to forget the details: sysadmins pushing a static site, engineers scripting a nightly archive, or anyone migrating data between buckets and accounts.

What the Generator Covers

• Five command types — sync for directory mirroring, cp and mv for individual transfers, rm for deletion, and ls for listing. Irrelevant options hide themselves as you switch, so you are never shown a flag that the selected command does not accept.
• Three transfer directions — local to S3 (upload), S3 to local (download), and S3 to S3 (between buckets). The source and destination fields relabel themselves accordingly.
• Behaviour flags — --recursive, --dryrun, --delete, --exact-timestamps, --size-only, --quiet, and --only-show-errors.
• Include and exclude filters — add as many --include and --exclude rules as you need, in order. The generator preserves the order you enter them, which is the part most people get wrong.
• Storage and access controls — canned ACLs (private, public-read, bucket-owner-full-control, and the rest) and every S3 storage class from STANDARD through INTELLIGENT_TIERING, GLACIER_IR, and DEEP_ARCHIVE.
• Encryption — --sse AES256 for SSE-S3, or --sse aws:kms plus --sse-kms-key-id when you supply a key.
• Environment — --profile, --region, and --endpoint-url for S3-compatible targets such as Cloudflare R2, MinIO, Backblaze B2, or Wasabi.
• Presets — one-click starting points for a website upload, a Glacier Deep Archive backup, a backup download, and a bucket-to-bucket mirror.
• Flag reference tab — a second tab that explains what each flag actually does, for when you want to understand the command rather than just run it.

How to Use It

1. Start from a preset if one fits. The four presets fill in a realistic configuration, including sensible filters, which you then edit rather than build from scratch.
2. Pick the command type and direction. These two choices decide which options are relevant, so set them before anything else.
3. Enter source and destination. S3 paths use the s3://bucket/prefix form; local paths can be relative or absolute.
4. Tick your flags. Leave --dryrun on for the first run of anything destructive.
5. Add filters in the right order. See the section below — order is significant.
6. Copy the command. The output is line-broken with backslash continuations so it stays readable when pasted into a script.

Sync, cp, and mv: Choosing the Right One

aws s3 sync compares source and destination and transfers only what differs. By default it compares size and last-modified time, and it never deletes anything on the destination unless you add --delete. That makes it the right choice for repeated operations — nightly backups, redeploying a static site, keeping a mirror current.

aws s3 cp copies unconditionally. It re-transfers files that already exist and are identical, which is wasteful for a mirror but exactly right when you want a single object moved or when you are piping data (aws s3 cp - s3://bucket/key reads from stdin). aws s3 mv is a copy followed by a delete of the source; if the copy fails partway through a recursive move, you can end up with objects in both places.

One flag difference catches people out constantly: --recursive is required for cp, mv, and rm when you are operating on a prefix, but sync is always recursive and rejects the flag.

How Include and Exclude Filters Actually Work

S3 filters are evaluated left to right, and every file starts out included. Each subsequent --exclude or --include can override the previous decision for a given path. That means the last matching rule wins, and the common idiom for “only these files” is to exclude everything first and then re-include what you want:

aws s3 sync ./dist s3://my-bucket --exclude "*" --include "*.html" --include "*.css"

Reverse those two and you get the opposite result — the --exclude "*" would run last and match everything, transferring nothing. The generator keeps your filters in the order you add them precisely so this behaviour is visible rather than hidden.

Two more details worth knowing. Patterns are matched against the whole key, not just the filename, so --exclude "*.map" works but --exclude "node_modules" does not — you want --exclude "node_modules/*". And filters apply to the source listing, so on a sync --delete an excluded destination object is treated as out of scope and is not deleted.

The Flags That Cost Money or Data

• --delete removes destination objects that no longer exist at the source. Point it at the wrong prefix and it empties a bucket. Always run it once with --dryrun first and read the (dryrun) delete: lines.
• --acl public-read makes objects world-readable. On buckets with Block Public Access enabled the command fails outright, which is a useful safety net; on buckets without it, the objects genuinely become public.
• --storage-class GLACIER or DEEP_ARCHIVE carries minimum storage durations (90 and 180 days). Objects deleted or overwritten before then still bill for the full period, so archiving churning data costs more than STANDARD.
• --size-only compares file size and ignores timestamps. It is fast and it is how you avoid re-uploading everything after a checkout resets mtimes — but a file edited without changing its byte count will be skipped.
• --exact-timestamps is download-only and forces a transfer when timestamps differ at all, rather than only when the source is newer.

Non-AWS S3 Endpoints

Because the CLI speaks the S3 API rather than an AWS-specific protocol, the same commands work against S3-compatible services once you set --endpoint-url. Cloudflare R2, MinIO, Wasabi, DigitalOcean Spaces, and Backblaze B2 all accept aws s3 sync this way. Expect some flags to be ignored or rejected: canned ACLs, storage classes, and KMS options are largely AWS-specific, and providers differ in which subset they implement. Test with --dryrun against a scratch bucket before wiring anything into a cron job. If you are pricing a migration, the Route 53 pricing calculator and the AWS Bedrock pricing calculator cover the adjacent line items.

Frequently Asked Questions

Does this tool run the command or connect to my AWS account?

No. It only builds the command text in your browser. Nothing is executed, no credentials are requested, and no data is sent to a server. You copy the result and run it yourself in a terminal that already has your credentials configured.

What is the difference between aws s3 and aws s3api?

aws s3 is the high-level interface with file-system-like verbs and automatic multipart handling. aws s3api exposes the raw S3 API operations one to one, which you need for things the high-level commands do not cover — bucket policies, lifecycle rules, versioning, object tagging. This generator builds aws s3 commands.

Why does my sync re-upload every file each time?

Almost always because the local modification times changed — a fresh git clone, a CI checkout, or a rebuilt artifact directory will do it. Adding --size-only compares byte counts instead of timestamps and usually fixes it, at the cost of missing edits that leave file size unchanged.

How do I sync only certain file types?

Exclude everything, then include what you want, in that order: --exclude "*" --include "*.jpg" --include "*.png". The rules are applied left to right and the last match wins.

Is --dryrun completely safe?

Yes. It prints the operations the command would perform, prefixed with (dryrun), and changes nothing. It is the correct first step for any command containing --delete, rm, or mv.

Can I use this for Cloudflare R2 or MinIO?

Yes — set the --endpoint-url field to your provider’s S3 endpoint. Be aware that ACLs, storage classes, and SSE-KMS options are AWS-specific and may be ignored or rejected elsewhere.

Why won’t sync accept --recursive?

Because sync is inherently recursive; the flag is only valid on cp, mv, and rm. The generator hides it when you select sync so the command it produces is always valid.

Is the tool free?

Yes — free, unlimited, and no account required, like our cron expression builder and the rest of the developer toolkit. AWS charges for the requests and data transfer that the resulting command performs; we charge nothing for building it.