An AWS access key is a programmatic credential made of an access key identifier and a secret access key. The AWS CLI uses these values to authenticate as an IAM user, while console sign-in uses a username and password. section 4.2.2 section 5.3.4
Handle access keys as high-impact credentials:
- Treat both values as top secret because anyone who obtains them may gain the permissions assigned to the IAM user. section 4.2.2
- Prefer an IAM user with only the permissions required for its role instead of using the AWS account root user. section 5.3 section 5.3.4
- Enable multifactor authentication for users, especially users with administrator access. section 5.3.4
Configure and test the AWS CLI
Create an IAM user with programmatic access, copy its access key identifier and secret access key, then run aws configure in a terminal. Enter the credentials, choose us-east-1 as the default region, select json output, and test authentication with aws ec2 describe-regions. section 4.2.2
$ aws configure AWS Access Key ID [None]: AKIAIRUR3YLPOSVD7ZCA #1 AWS Secret Access Key [None]: SSKIng7jkAKERpcT3YphX4cD87sBYgWVw2enqBj7 #2 Default region name [None]: us-east-1 Default output format [None]: json #1 Your value will be different! Copy it from your browser window. #2 Your value will be different! Copy it from your browser window.
Shows the smallest useful aws configure sequence with placeholders for the access key values, region, and output format. section 4.2.2
