CloudPilotGet AWS credentials and manage profiles
Obtain AWS API credentials first, then save them in CloudPilot. Follow either the IAM user key steps or the IAM Identity Center temporary-credential steps, according to how you access AWS.
Updated October 8, 2026
Choose the credential type
The panel needs AWS API credentials. IAM user keys contain an Access Key ID and Secret Access Key; temporary credentials also contain a Session Token. If you sign in through an organization’s AWS access portal, use the temporary-credential method below. An AWS sign-in email, console password, 12-digit account ID or EC2 .pem private key does not replace these fields.
Method A: open IAM and choose a user
Sign in to the AWS console, open IAM and select the intended IAM user from Users. Do not create root-user access keys for the panel. If your organization provides only role access and no IAM user, use Method B or contact your administrator.
Create a dedicated IAM user if needed
An account with IAM administration permissions can create a user under Users → Create user, for example cloudpilot. Console sign-in is unnecessary for a user used only by the panel’s API calls. Assign an appropriate group or permission policies, review the settings and create the user. Skip this step if a suitable user already exists.
Assign permissions for the features you use
Use the user’s Permissions page to assign groups or policies for the EC2, Lightsail, SSM and other operations you need. A key inherits its user’s permissions; creating it does not grant administrator access. Ask an AWS administrator if you cannot manage users, keys or policies, and scope permissions to the required features.
Create an access key
Open the selected user’s security-credentials tab and create a key in its access-key area. Review AWS’s use-case guidance and alternatives. If a long-term key is required, proceed with Other, optionally describe its purpose, and create the key.
Save the ID and secret together
On the result page, copy the access key ID and reveal and copy its matching secret, or download the CSV to a secure location. The secret cannot be retrieved after this creation screen is closed. Keep the pair together. Leave Session Token empty for a long-term IAM user key.
Method B: get temporary credentials from the AWS access portal
Sign in to the AWS access portal provided by your administrator. Expand the target account under Accounts and find your assigned role. Open its Access keys or Command line or programmatic access link. If the account or role is absent, ask your administrator to assign access.
Copy all three temporary credential values
Use the individual-value option, usually Option 3, to copy the key ID, secret and session token. Environment-variable equivalents are AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN. Paste values only, without export commands or surrounding quotes. All three must come from the same retrieval.
Fill in and save the panel profile
In CloudPilot Credentials, add a profile with a recognizable name. Enter the key ID in Access Key ID and its matching secret in Secret Access Key. Include the full Session Token for temporary credentials; leave it blank for long-term IAM keys. Save and select the profile, then compare the returned 12-digit AWS account ID with your intended account.
Refresh an expired temporary profile
Saving temporary credentials does not extend their lifetime or enable automatic renewal in the panel. On an expiry error such as ExpiredToken, retrieve fresh portal credentials and replace the key ID, secret and token together in the existing profile. Do not mix a new token with an older key pair.
Find, switch and import profiles
Search Saved profiles by name or 12-digit AWS account ID, select one, and check Current credential in the dashboard. For multiple sets, follow the bulk-import dialog’s CSV, key=value or JSON format. If an AWS-downloaded file uses different fields, adapt it to the panel’s template first.
Distinguish invalid credentials from missing permissions
For invalid-token or signature errors, check that the key pair matches, all values were copied completely, and any temporary token is present and unexpired. AccessDenied after successful identity validation calls for checking feature permissions, permissions boundaries or organization restrictions. Recreating a key does not increase permissions.
Your CloudPilot account and AWS credentials serve different purposes. Save keys only in a panel you trust and hide secrets and session tokens in screenshots. Handle lost or exposed keys in AWS IAM and replace the panel profile.
Open panel credential profiles (new tab)