minimal
GitHub
  1. Images
  2. Kubernetes, CI & IaC
  3. aws-cli

aws-cli

AWS CLI v2 command-line client for managing Amazon Web Services from scripts and CI. Shell-less, non-root, signed and SBOM-attested, rebuilt daily.

Vulnerabilities
Compressed size
53 MB
Architectures
amd64, arm64
Default user
nonroot (65532)
Last built
today
Upstream
aws.amazon.com/cli

Pull this image

docker pull ghcr.io/rtvkiz/minimal-aws-cli:latest
Repository
ghcr.io/rtvkiz/minimal-aws-cli
Digest
sha256:6c73f0f5b26ebb97c13298cc2225559a890d4661b3da2876c996655ae539000d
Built at
2026-11-12T07:09:59Z
Primary package
aws-cli-2
Entrypoint
/usr/bin/aws
User
nonroot (65532)
Working dir
/aws
Architectures
x86_64, aarch64
Environment
PATH=/usr/bin:/binHOME=/home/nonrootAWS_PAGER=
Labels
org.opencontainers.image.titleminimal-aws-cli
org.opencontainers.image.descriptionHardened shell-less AWS CLI v2 image built on Wolfi with daily CVE patches
org.opencontainers.image.urlhttps://github.com/rtvkiz/minimal
org.opencontainers.image.sourcehttps://github.com/rtvkiz/minimal/tree/main/images/aws-cli
org.opencontainers.image.licensesApache-2.0
TagPullPublished
2 ghcr.io/rtvkiz/minimal-aws-cli:2 2026-11-12
2.40 ghcr.io/rtvkiz/minimal-aws-cli:2.40 2026-11-12
2.40.1-r0 ghcr.io/rtvkiz/minimal-aws-cli:2.40.1-r0 2026-11-12
2.40.1-r0-20261112 ghcr.io/rtvkiz/minimal-aws-cli:2.40.1-r0-20261112 2026-11-12
latest ghcr.io/rtvkiz/minimal-aws-cli:latest 2026-11-12
2-dev ghcr.io/rtvkiz/minimal-aws-cli:2-dev 2026-11-12
2.40-dev ghcr.io/rtvkiz/minimal-aws-cli:2.40-dev 2026-11-12
2.40.1-r0-20261112-dev ghcr.io/rtvkiz/minimal-aws-cli:2.40.1-r0-20261112-dev 2026-11-12
2.40.1-r0-dev ghcr.io/rtvkiz/minimal-aws-cli:2.40.1-r0-dev 2026-11-12
latest-dev ghcr.io/rtvkiz/minimal-aws-cli:latest-dev 2026-11-12
2.40.0-r0-20261111-dev ghcr.io/rtvkiz/minimal-aws-cli:2.40.0-r0-20261111-dev 2026-11-11
2.40.0-r0-dev ghcr.io/rtvkiz/minimal-aws-cli:2.40.0-r0-dev 2026-11-11
2.40.0-r0 ghcr.io/rtvkiz/minimal-aws-cli:2.40.0-r0 2026-11-11
2.40.0-r0-20261111 ghcr.io/rtvkiz/minimal-aws-cli:2.40.0-r0-20261111 2026-11-11
2.39 ghcr.io/rtvkiz/minimal-aws-cli:2.39 2026-11-10
2.39.6-r0 ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0 2026-11-10
2.39.6-r0-20261110 ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0-20261110 2026-11-10
2.39-dev ghcr.io/rtvkiz/minimal-aws-cli:2.39-dev 2026-11-10
2.39.6-r0-20261110-dev ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0-20261110-dev 2026-11-10
2.39.6-r0-dev ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0-dev 2026-11-10
2.39.6-r0-20261109-dev ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0-20261109-dev 2026-11-09
2.39.6-r0-20261109 ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0-20261109 2026-11-09
2.39.6-r0-20261108 ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0-20261108 2026-11-08
2.39.6-r0-20261108-dev ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0-20261108-dev 2026-11-08
2.39.6-r0-20261107 ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0-20261107 2026-11-07
2.39.6-r0-20261107-dev ghcr.io/rtvkiz/minimal-aws-cli:2.39.6-r0-20261107-dev 2026-11-07
2.39.4-r0 ghcr.io/rtvkiz/minimal-aws-cli:2.39.4-r0 2026-11-06
2.39.4-r0-20261106 ghcr.io/rtvkiz/minimal-aws-cli:2.39.4-r0-20261106 2026-11-06
2.39.4-r0-20261106-dev ghcr.io/rtvkiz/minimal-aws-cli:2.39.4-r0-20261106-dev 2026-11-06
2.39.4-r0-dev ghcr.io/rtvkiz/minimal-aws-cli:2.39.4-r0-dev 2026-11-06

155 packages in the image, resolved from the SPDX SBOM.

PackageVersionLicense
alpine/ca-certificates20261020MPL-2.0 AND MIT
aws-cli2.40.1Apache-2.0
aws-cli-22.40.1-r0Apache-2.0
aws-cli-22.40.1-r0Apache-2.0
aws-cli-22.40.1-r0—
aws-cli-2.yaml1cf6cd4be359a88585a308f30bdfcc6f507da7d0Apache-2.0
awscli2.40.1—
awscrt0.38.1Apache-2.0
brotliv1.2.1MIT
brotli.yamlf5ef816d1cb2bd0e165a402c4e8a4c4622464bf3Apache-2.0
bzip2.yaml6ea997c2746016cbc0225ce27cb992c09feefd2aApache-2.0
ca-certificates-bundle20261020-r0MPL-2.0 AND MIT
ca-certificates-bundle20261020-r0(MPL-2.0 AND MIT)
ca-certificates-bundle20261020-r0—
ca-certificates.yaml8061afafa65af5a9026707a8880e14120dd6f4a0Apache-2.0
colorama0.4.6BSD-3-Clause
cpython3e7fff9d09cc502dbe0de4808291ff48b2ffdc11PSF-2.0
distro1.8.0LicenseRef-Apache-License--Version-2.0
docutils0.19LicenseRef-public-domain--Python--2-Clause-BSD--GPL-3--see-COPYING.txt-
expat.yaml5aeb575ed7ca64fb21dfda042e170d08f1654bbcApache-2.0
gcc.yaml4d188060cbd00821a95f1ef60605da4817e781bbApache-2.0
gdbm1.26-r9GPL-3.0-or-later
gdbm1.26-r9GPL-3.0-or-later
gdbm1.26-r9—
gdbm.yamlbdc197227f39597f43727c03854efbb4e834c5efApache-2.0
git/bzip2bzip2-1.0.8bzip2-1.0.6
git/gdbmv1.26GPL-3.0-or-later
git/groff1.25.0GPL-3.0-or-later
git/readlinereadline-8.3GPL-3.0-or-later
glibc-2.442.44-r16LGPL-2.1-or-later
glibc-2.442.44-r16LGPL-2.1-or-later
glibc-2.442.44-r16—
glibc-2.44-locale-posix2.44-r16LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r16LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r16—
glibc-2.44.yaml69c2b75e0711c38be3c5881e3a141667ccf54341Apache-2.0
gnutools/gccreleases/gcc-16.2.0GPL-3.0-or-later WITH GCC-exception-3.1
gnutools/glibc47e2b570410fab606de29f550534a721184852c3LGPL-2.1-or-later
groff-base1.25.0-r0GPL-3.0-or-later
groff-base1.25.0-r0GPL-3.0-or-later
groff-base1.25.0-r0—
groff.yamlc8e7bee5fe92e30c8c22f2fdc27ebf6d9296a614Apache-2.0
jmespath1.0.1MIT
ld-linux-2.442.44-r16LGPL-2.1-or-later
ld-linux-2.442.44-r16LGPL-2.1-or-later
ld-linux-2.442.44-r16—
libbrotlicommon11.2.1-r3MIT
libbrotlicommon11.2.1-r3MIT
libbrotlicommon11.2.1-r3—
libbrotlidec11.2.1-r3MIT
libbrotlidec11.2.1-r3MIT
libbrotlidec11.2.1-r3—
libbrotlienc11.2.1-r3MIT
libbrotlienc11.2.1-r3MIT
libbrotlienc11.2.1-r3—
libbz2-11.0.8-r31bzip2-1.0.6
libbz2-11.0.8-r31bzip2-1.0.6
libbz2-11.0.8-r31—
libexpatR_2_10_0MIT
libexpat12.10.0-r1MIT
libexpat12.10.0-r1MIT
libexpat12.10.0-r1—
libffi3.8.0-r2MIT
libffiv3.8.0MIT
libffi3.8.0-r2MIT
libffi3.8.0-r2—
libffi.yamlaaa2344b75ef8b19889f087c91e10b11f191e15cApache-2.0
libgcc16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libgcc16.2.0-r3(GPL-3.0-or-later WITH GCC-exception-3.1)
libgcc16.2.0-r3—
libstdc++16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libstdc++16.2.0-r3(GPL-3.0-or-later WITH GCC-exception-3.1)
libstdc++16.2.0-r3—
libuuid2.42.4-r2GPL-3.0-or-later AND GPL-2.0-or-later AND GPL-2.0-only AND GPL-1.0-only AND LGPL-2.1-or-later AND BSD-1-Clause AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND MIT AND CC-PDDC
libuuid2.42.4-r2(GPL-3.0-or-later AND GPL-2.0-or-later AND GPL-2.0-only AND GPL-1.0-only AND LGPL-2.1-or-later AND BSD-1-Clause AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND MIT AND CC-PDDC)
libuuid2.42.4-r2—
libzstd11.5.7-r13BSD-2-Clause AND GPL-2.0-only
libzstd11.5.7-r13(BSD-2-Clause AND GPL-2.0-only)
libzstd11.5.7-r13—
mpdecimal4.0.1-r6BSD-2-Clause
mpdecimal4.0.1—
mpdecimal4.0.1-r6BSD-2-Clause
mpdecimal4.0.1-r6—
mpdecimal.yaml491b184c82ef2868d73a46a98997db789342ff15Apache-2.0
msgpack-pythonv1.2.3MIT
ncurses6.6.20261107-r0MIT
ncurses6.6.20261107-r0MIT
ncurses6.6.20261107-r0—
ncurses-snapshotsv6_6_20261107MIT
ncurses-terminfo-base6.6.20261107-r0MIT
ncurses-terminfo-base6.6.20261107-r0MIT
ncurses-terminfo-base6.6.20261107-r0—
ncurses.yaml57b90c0084b0bc101663cdfcaa44f4ce83312443Apache-2.0
opensslopenssl-4.1.0Apache-2.0
opensslopenssl-4.0.3Apache-2.0
openssl-4.0-libcrypto4.0.3-r8Apache-2.0
openssl-4.0-libcrypto4.0.3-r8Apache-2.0
openssl-4.0-libcrypto4.0.3-r8—
openssl-4.0-libssl4.0.3-r8Apache-2.0
openssl-4.0-libssl4.0.3-r8Apache-2.0
openssl-4.0-libssl4.0.3-r8—
openssl-4.0.yaml53fb2f6751f832fa61ddba06cb8a40dbba5f409fApache-2.0
openssl-provider-legacy-allowed4.1.0-r0Apache-2.0
openssl-provider-legacy-allowed4.1.0-r0Apache-2.0
openssl-provider-legacy-allowed4.1.0-r0—
openssl-provider-legacy-allowed.yamlaeae4801330be6fd269d5ed5640dc37b58ccab09Apache-2.0
pip26.2.2MIT
pip26.2.2—
prompt-toolkit3.0.51—
py3-pip-wheel26.2.2-r2MIT
py3-pip-wheel26.2.2-r2MIT
py3-pip-wheel26.2.2-r2—
py3-pip.yaml58b78718f8e8947523a1ad3eb0deb82aee6911d7Apache-2.0
python-3.14-base3.14.10_git20261111-r0PSF-2.0
python-3.14-base3.14.10_git20261111-r0PSF-2.0
python-3.14-base3.14.10_git20261111-r0—
python-3.14.yaml2283fc0b206ee1f8c592ed0633b432fa86f5a9c3Apache-2.0
python-certifi2026.10.23MIT
python-dateutil2.9.0LicenseRef-Dual-License
readline8.3-r3GPL-3.0-or-later
readline8.3-r3GPL-3.0-or-later
readline8.3-r3—
readline.yaml20a5359ac0a7a6aca23efa343f0f29c8d3ea1453Apache-2.0
ruamel-yaml0.19.1MIT
ruamel-yaml-clib0.2.15MIT
sha256:3ab5a0f99bfa55ae89d9f210c069edf501affcf418d7b1a15d03a2dfdf04d98720230201—
sha256:d71f55817061a2c917a1c88ee9c9cecb786ba6d67effe169538897ce0cf0daf2sha256:d71f55817061a2c917a1c88ee9c9cecb786ba6d67effe169538897ce0cf0daf2—
six1.17.0MIT
sqlite3.54.1—
sqlite-libs3.54.1-r0blessing
sqlite-libs3.54.1-r0blessing
sqlite-libs3.54.1-r0—
sqlite.yamlb0ca8c95606371be2557980059c10b34df30fa9fApache-2.0
urllib32.8.0MIT
urllib32.8.0MIT
util-linuxv2.42.4GPL-3.0-or-later AND GPL-2.0-or-later AND GPL-2.0-only AND GPL-1.0-only AND LGPL-2.1-or-later AND BSD-1-Clause AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND MIT AND CC-PDDC
util-linux.yaml8298ba7be686605b03c1943f22ccf5a0640e0042Apache-2.0
wcwidth0.2.14MIT
wolfi20230201—
wolfi-baselayout20230201-r31MIT
wolfi-baselayout20230201-r31MIT
wolfi-baselayout20230201-r31—
wolfi-baselayout.yamled415005c84750f03c4a9252137813734a224ae7Apache-2.0
xz5.8.4-r1GPL-3.0-or-later
xzv5.8.4GPL-3.0-or-later
xz5.8.4-r1GPL-3.0-or-later
xz5.8.4-r1—
xz.yaml5aeb575ed7ca64fb21dfda042e170d08f1654bbcApache-2.0
zlib1.3.2.1_rc20260921-r2MPL-2.0 AND MIT
zlib767c4c947852e143f582c85f14cf573411df1b35MPL-2.0 AND MIT
zlib1.3.2.1_rc20260921-r2(MPL-2.0 AND MIT)
zlib1.3.2.1_rc20260921-r2—
zlib.yaml5aeb575ed7ca64fb21dfda042e170d08f1654bbcApache-2.0
zstdv1.5.7BSD-2-Clause AND GPL-2.0-only
zstd.yaml0d1cb8462683e2c06d7591b8b4ad4d1f2797a0f7Apache-2.0
1 high 0 fixable
CVESeverityPackageInstalledFixed in
CVE-2026-84243 High glibc-2.44 2.44-r16 —

Everything is verifiable without an account. Copy and run:

Build provenance (SLSA v1.0, Build L2)

gh attestation verify oci://ghcr.io/rtvkiz/minimal-aws-cli:latest --owner rtvkiz

Cosign signature

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-aws-cli:latest

SBOM attestation (SPDX)

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-aws-cli:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Signatures are logged in the public Rekor transparency log.

More Kubernetes, CI & IaC images

airflowargo-cdargo-cd-repo-serverkarpenterkedabuildkitconftestcosign

Weighing this against another provider? The comparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read the migration guide for what actually breaks when you switch.