newerkey notes
// Cloud · 20 March 2026 · 3 min read

Create and Manage an IAM User (AWS)

How to create a least-privilege IAM user, generate access keys for the CLI, and why the root account should never be the default.

aws iam security cli cloud

Creating an IAM user with security considerations is one of the first tasks every AWS user should know. This covers how to create an IAM user, attach a policy, and connect the CLI.

Why IAM Users Instead of Root

The root account has complete access to every AWS service and resource. Using it for day-to-day work is the same as doing all your Linux work as root — it works, but the blast radius of a mistake or leaked credential is total.

IAM users let you apply the principle of least privilege: give the user exactly the permissions it needs for the job it does. An S3 user gets S3 access. A billing reviewer gets read-only billing access. Nothing more.

Configuring the AWS CLI

The CLI is the fastest way to work with AWS. Install it following the official instructions for your OS.

Verify the installation:

aws --version
# aws-cli/2.11.1 Python/3.11.4 ...

Create the IAM User

Sign in to the AWS Management Console. Search for IAM and navigate to the IAM dashboard.

  1. From the left menu, choose Users
  2. Click Add User
  3. Set a username and configure the password (also select AWS Management Console access if the user needs console access)
  4. In Set Permissions, attach a policy. For a user that needs S3 access, attach AmazonS3FullAccess
  5. Review and create the user

Create Access Keys for CLI Access

After creating the user, click on the username to open its details. Under Security Credentials, create an access key.

Select Command Line Interface (CLI) as the use case. On the final page, you can view the access key and secret access key. Download the .csv file — you won’t be able to see the secret key again after leaving this page.

Connect to the AWS CLI

Configure the CLI with the new user’s credentials:

aws configure

Enter the access key, secret access key, default region, and output format when prompted.

The CLI stores credentials in ~/.aws/credentials (or %UserProfile%\.aws\credentials on Windows):

[default]
aws_access_key_id = AKIA...
aws_secret_access_key = ...
region = eu-west-1

Verify the configuration works:

aws sts get-caller-identity

This returns the account ID and IAM user ARN — confirming the CLI is authenticated as the correct user.

Key Points

  • Never use the root account for day-to-day work or programmatic access
  • Apply least-privilege permissions — give the user only the access it needs
  • Download the credentials CSV immediately — the secret access key is shown only once
  • If a key is compromised, deactivate it in the IAM console and generate a new one
  • Prefer IAM roles over long-lived access keys where possible (Lambda, EC2, ECS)