An IAM user is a long-term AWS identity for a person or an external workload. IAM authenticates the user and applies identity policies to authorize AWS API actions. section 5.3.2 section 5.3.2
Use IAM users to:
- Authenticate through a Management Console username and password or through access keys used by the CLI. section 5.3.4
- Assign permissions directly or through groups, following least privilege by giving each person only the required resource access. section 5.3.4
- Separate human or external-workload access from IAM roles, which authenticate AWS resources such as EC2 instances. section 5.3.2
- Protect access with MFA, especially for users with administrator permissions, and avoid using the unrestricted root user. section 5.3 section 5.3.4
Create a CLI and console user
Create the mycli user with programmatic access, attach a policy, and run aws configure with its access key, secret key, us-east-1, and JSON output. For console access, create an admin group, attach AdministratorAccess, create myuser, add it to the group, create its login profile, and enable MFA. section 4.2.2 section 5.3.4
$ aws iam create-group --group-name "admin" $ aws iam attach-group-policy --group-name "admin" \ --policy-arn "arn:aws:iam::aws:policy/AdministratorAccess" $ aws iam create-user --user-name "myuser" $ aws iam add-user-to-group --group-name "admin" --user-name "myuser" $ aws iam create-login-profile --user-name "myuser" --password '$Password'
Browse the CLI sequence for creating an administrator group, creating an IAM user, assigning group membership, and creating console credentials. section 5.3.4
