Introduction

Selective download in the AWS CLI usually means copying only certain S3 objects instead of the entire bucket or prefix. The standard tool is aws s3 cp with --recursive, --exclude, and --include filters, or a direct cp command when you already know the exact object key.

Download One Exact Object

If you already know the full S3 key, use a simple copy command.

aws s3 cp s3://my-bucket/reports/2025-01.csv ./2025-01.csv

This is the cleanest form of selective download because no filtering logic is needed.

Download A Filtered Set Of Objects

When you need multiple files under a prefix, the AWS CLI documentation recommends combining recursive copy with --exclude and --include filters.

1aws s3 cp s3://my-bucket/logs/ ./logs/ \
2  --recursive \
3  --exclude "*" \
4  --include "*.log"

This downloads only objects ending in .log under the logs/ prefix.

Why --exclude "*" Comes First

The AWS CLI command reference points out an easy-to-miss rule: by default, all files are included. That means --include alone does not narrow the transfer.

The normal selective pattern is:

• exclude everything first
• re-include the files you want

So this works:

1aws s3 cp s3://my-bucket/data/ ./data/ \
2  --recursive \
3  --exclude "*" \
4  --include "*.csv"

But this usually does not do what people expect:

aws s3 cp s3://my-bucket/data/ ./data/ --recursive --include "*.csv"

Without the initial exclusion, all objects remain eligible.

Combine Multiple Patterns

You can include more than one pattern.

1aws s3 cp s3://my-bucket/assets/ ./assets/ \
2  --recursive \
3  --exclude "*" \
4  --include "*.png" \
5  --include "*.jpg"

This is useful when a local folder should receive only a subset of image or report types.

Filter By Prefix When Possible

If the desired objects already live under a clean prefix, use the narrowest S3 path you can. It reduces scanning work and makes the command easier to reason about.

aws s3 cp s3://my-bucket/reports/2025/ ./reports/2025/ --recursive

Then add filters only if the prefix still contains more objects than you want.

Use --dryrun Before Large Transfers

Selective filters are easy to get wrong. The safest habit is to preview the transfer first.

1aws s3 cp s3://my-bucket/logs/ ./logs/ \
2  --recursive \
3  --exclude "*" \
4  --include "*.log" \
5  --dryrun

That prints what would be copied without downloading anything.

Include And Exclude Work For Uploads Too

The same filter pattern works in the opposite direction when copying from local files to S3. That is useful when you want one mental model for both upload and download filtering rather than learning two separate command styles.

cp Versus sync

aws s3 sync can also use include and exclude filters, but cp is often clearer when the task is explicitly "download these matching objects." Use sync when you want destination contents to mirror a source tree more closely.

For one-off targeted retrieval, cp is usually simpler.

Common Pitfalls

A common mistake is using --include without first excluding everything. According to the AWS CLI documentation, --include only re-includes objects that were excluded.

Another mistake is starting from the bucket root when a narrower prefix is available. That makes filtering slower and easier to misread.

It is also easy to forget --dryrun. On large buckets, a bad pattern can pull far more data than intended.

Summary

• Use direct aws s3 cp when you know the exact object key.
• Use --recursive --exclude "*" --include "pattern" for selective multi-object downloads.
• Start from the narrowest useful prefix in S3.
• Use multiple --include filters when needed.
• Run with --dryrun first when the transfer scope is nontrivial.