How to create an IAM user in AWS

AWS still lets you create IAM users, but an IAM user with a long-lived access key should not be your default.

For people, AWS recommends IAM Identity Center and temporary credentials. For applications running on AWS, use an IAM role. Both options avoid access keys that remain valid until you rotate or delete them.

Create an IAM user only when the tool or workload cannot use federation or an IAM role.

Create the user

Open the AWS console, go to IAM → Users, and choose Create user. The exact labels in the console change over time, but the important decisions are the credentials and permissions you give the user.

Do not enable console access unless the user needs to sign in to the AWS console. If console access is required, enforce MFA.

Attach only the permissions the workload needs. Avoid broad policies such as AmazonS3FullAccess for an upload script. A policy can instead limit access to one bucket and the exact S3 actions required.

After creating the user, open its Security credentials tab and create an access key only if the workload requires one. AWS shows the secret access key once.

Store the credentials in a secret manager or the standard AWS credentials file. Do not put them in source code, commit them to Git, or expose them in client-side environment variables.

For local development, the AWS CLI can store a named profile:

aws configure --profile my-app

Then select it with AWS_PROFILE=my-app when running your application.

Review the user regularly, rotate or remove unused keys, and delete the user when the integration no longer needs it. AWS keeps its current recommendations in the IAM security best practices.