How to Create an AWS Access Key ID and Secret Access Key

Root user or IAM user?

Signing in with the email address and password you registered with makes you the root user, which has full access to the account. AWS documentation is explicit: do not use root credentials to create access keys, because a leaked key could give someone permanent access to your account. Create a separate IAM user for the application or tool, grant only the permissions it needs, and create the access key for that user.

An access key has two parts: the access key ID (for example AKIAIOSFODNN7EXAMPLE) and the secret access key. You need both together to sign API requests.

If your organization signs in to AWS through IAM Identity Center, you usually don't need a long-term key at all; use the temporary credentials described below. AWS recommends temporary credentials whenever possible.

Step 1: Create a dedicated IAM user

1. Sign in to the AWS Management Console with an identity that can manage IAM, and open the IAM console.
2. In the navigation pane, choose Users, then Create user.
3. On Specify user details, enter a user name such as deploy-bot. A user that only makes API calls doesn't need console sign-in.
4. On Set permissions, add the user to a group or attach policies directly, choosing only what this use case needs.
5. Review the settings and choose Create user.

Step 2: Create the access key

1. In the Users list, choose the user name to open its details page.
2. Open the Security credentials tab and choose Create access key in the Access keys section. If the button is disabled, the user already has two keys and you must delete one first.
3. On Access key best practices & alternatives, pick your use case and review the alternatives AWS suggests. If you still need a long-term key, choose Other and then Next.
4. (Optional) Add a description tag that records what the key is for, then choose Create access key.
5. On Retrieve access keys, choose Show to reveal the secret access key, or choose Download .csv file and store it somewhere secure.

This is your only chance to view or download the secret access key. After you leave the page, the console shows only the access key ID and the secret can't be recovered. A new key is active by default and works immediately.

Lost the secret, or need to rotate?

You can't recover a secret from its access key ID. AWS's answer is to delete the old key and create a new one. To avoid breaking applications that still use it, replace the key in this order, which is also the standard rotation procedure:

1. While the old key is still active, create a second access key for the same user.
2. Update every application and tool to use the new key.
3. Check the old key's Last used information; waiting a few days is a good way to confirm nothing still calls it.
4. Under Actions, deactivate the old key rather than deleting it. If something breaks, you can reactivate it.
5. Once everything works, delete the old key. Deletion can't be undone.

Use temporary credentials from IAM Identity Center

If your account uses IAM Identity Center, you can get temporary credentials from the AWS access portal instead of creating a long-term key:

1. Sign in to the AWS access portal with the URL your administrator gave you.
2. On the Accounts tab, expand the target account to see the role (permission set) assigned to you.
3. Choose Access keys or Command line or programmatic access next to the role.
4. In the Get credentials dialog, pick your operating system and copy what you need: Option 1 sets environment variables, Option 2 adds a profile to your credentials file, and Option 3 gives individual values.

Temporary credentials add a session token (AWS_SESSION_TOKEN) to the key ID and secret. All three must come from the same retrieval and be used together. The session lasts 1 to 12 hours depending on the permission set, 1 hour by default, and you must fetch new credentials when it expires.

Permissions, limits and housekeeping

• Least privilege: grant only the actions the application needs. The PowerUserAccess policy used in AWS's getting-started example covers every service except IAM and Organizations, so use a tighter policy in production.
• Limit: an IAM user can have at most two access keys. With two already in place, you must delete one, not just deactivate it, before creating another.
• Never put keys in source code or commit them to a repository. AWS also notes that keys in the shared credentials file are stored in plaintext.
• Review regularly: turn on the Access key age and Access key last used columns in the IAM users list to find keys that are old or unused.
• Deactivate keys you no longer use, wait a while, then delete them.

Using the key with CloudPilot

CloudPilot is a web control panel for AWS. Under Credentials you can save several profiles: enter the access key ID and secret for an IAM user key, plus the session token for IAM Identity Center credentials. After you save and select a profile, the panel shows its 12-digit AWS account ID so you can confirm it's the right account. Credentials are encrypted on the server and can be deleted at any time, and what the panel can do depends on the key's own IAM permissions.

FAQ