How to run aws cli with www-data?
I'd say you can:


Using pip, install aws-cli for the www-data user specifically. 
Example:

pip install awscli --user
Copying aws binary to some folder (for example awsonlybin) where it is the only command there and then adding the path of this folder to the www-data user's PATH. Example:

export PATH=$PATH:/usr/local/awsonlybin


In addition to that you should also do one of the following options:


Create an IAM user and access and secret keys and attach a relevant IAM policy to that user and then configure awscli to use that access key and configure them under the www-data user.
Create an IAM role and attach a relevant policy to that role and attach the role to that instance.