Running the `aws update` command in the PowerShell 7 console fails.

[stknohg]

Describe the bug

My environment is PowerShell 7.6.4 on Windows 11 and Windows Server 2025.
The console is running with administrator privileges.

# PowerShell 7.6.4
PS C:\> aws --version
aws-cli/2.36.0 Python/3.14.6 Windows/2025Server exec-env/EC2 exe/AMD64

When I run the aws update command in the PowerShell 7 console, the installation script executes in a separate window, downloads the latest version of the MSI installer file, and then immediately exits.

When I ran the downloaded aws-update.cmd, it failed to load the Get-AuthenticodeSignature cmdlet.

# Run the downloaded aws-update.cmd to reproduce the issue.
PS C:\Users\Administrator\AppData\Local\Temp\2\tmpy48h7xd1> .\aws-update.cmd
Installing AWS CLI 2.36.0 -> 2.36.15
Downloading AWS CLI installer from https://awscli.amazonaws.com/AWSCLIV2-2.36.15.msi?src=update-exe
aws-cli installer: error: The 'Get-AuthenticodeSignature' command was found in the module 'Microsoft.PowerShell.Security', but the module could not be loaded. For more information, run 'Import-Module Microsoft.PowerShell.Security'.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

The script continues without errors, and the MSI installer runs.

Current Behavior

The script terminates after failing to load the Get-AuthenticodeSignature cmdlet.

Reproduction Steps

Run the aws update command in a PowerShell 7 console.

Possible Solution

aws update command launches Windows PowerShell to execute the update script, but because it inherits the PSModulePath environment variable from the PowerShell 7 environment, the module resolution order is not as intended.

# Default PowerShell 7 PSModulePath: 
PS C:\> $env:PSModulePath
C:\Users\Administrator\Documents\PowerShell\Modules;C:\Program Files\PowerShell\Modules;c:\program files\powershell\7\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files\WindowsPowerShell\Modules

# Default Windows PowerShell PSModulePath: 
PS C:\> $env:PSModulePath
C:\Users\Administrator\Documents\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files\WindowsPowerShell\Modules

The direct cause is that the Windows PowerShell script references C:\Program Files\PowerShell\Modules.
Adjusting the search order of PSModulePath will resolve the error.

To take an extreme example, the issue can be resolved by modifying aws-update.cmd as follows.

@echo off
set AWS_CLI_DISTRIBUTION_SOURCE_OVERRIDE=update-exe
ping -n 3 127.0.0.1 >nul 2>&1

REM Set PSModulePath to a fixed value.
set PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -NoProfile -File "C:\Users\ADMINI~1\AppData\Local\Temp\2\tmpy48h7xd1\install.ps1" -System

Additional Information/Context

Incidentally, running the aws update command in the PowerShell 5.1 console completes successfully.

CLI version used

2.36.0

Environment details (OS name and version, etc.)

PowerShell 7 on Windows 11, Windows Server 2025

[stknohg]

Workaround is to execute install.ps1 directly in PowerShell 7 console.

# system install
Invoke-Expression "& { $(Invoke-RestMethod 'https://awscli.amazonaws.com/v2/install.ps1') } -System"

# user install
Invoke-RestMethod -Uri https://awscli.amazonaws.com/v2/install.ps1 | Invoke-Expression