# Version pinning for AWS tooling
## The rule
Automation pins its AWS tooling versions. Unpinned installs drift, and drift breaks runs at 3am.
## AWS CLI v1 vs v2
1. AWS CLI v2 is the current major line: new installer, SSO support, and features that never backported to v1.
2. Scripts that assume v1 paths or flags break on v2 machines and vice versa. Check `aws --version` at the start of any automation that shells out, and fail fast on the wrong major.
3. Install v2 explicitly in CI images and agent sandboxes rather than taking whatever the base image ships.
## boto3 and botocore
1. Pin boto3 and botocore in requirements files. botocore updates change pagination behavior, retry defaults, and occasionally API shapes.
2. When upgrading, run the automation's test suite in a sandbox account first. Read the botocore changelog for the services you actually call.
3. Keep the pin fresh on a schedule. A two-year-old pin accumulates known bugs; a floating install accumulates surprises.