This article explains what is IAM user is and the steps to create an IAM user in aws.

large_iam user.png

medium_iam user.png

small_iam user.png

thumbnail_iam user.png

iam user.png

How to Create IAM User in AWS?

The AWS admin can grant full access to Amazon Simple Storage Service or the Amazon Elastic Compute Cloud, but there isn't a third platform for it. The security approach is more transparent and consistent than individually configuring account access.&nbsp;<a href="https://devopsden.io/article/what-is-aws-and-how-it-works">Amazon Web Services (AWS)</a>, as the name suggests, is the most comprehensively functioning and broadly adopted cloud service worldwide. AWS offers more than 200 fully featured services extended from globally functional data centers.&nbsp;Customers use many portals and platforms where tons of information is available; hence, controlling the same has become important with time. AWS, through IAM users, offers support to customers to gain control over what they can see and regulates the use of the platform’s resources and services.&nbsp;<h2>About IAM User</h2>Identity and Access Management (IAM) is a web service that helps users gain secure control access to the AWS pool of resources. Users can use it to centrally manage all kinds of permissions for controlling the AWS resources that revolve around user access issues. It helps control who is signed in through the account and who has been authorized or permitted to use the resources provided by the platform.&nbsp;Creating an AWS account is essential as it provides the user with one sign-in identity that has complete access to the services and resources linked to that particular account. This identity is called the root user, but it is not recommended for everyday tasks. Safeguarding the credentials is a requirement, as specific tasks can only be performed by the root user.&nbsp;<h2>Steps To Create An IAM User In Your AWS Account&nbsp;</h2>The process of creating a user and enabling the user to perform the work tasks is an easy job. The steps for the same are as follows:&nbsp;<h3>Creating A User From The AWS Management Console&nbsp;</h3>To create a user in AWS, you have to fill out a form, which is followed by receiving an access ID and a secret key to grant access.&nbsp;Step 1: Sign in to the AWS Management console as a ROOT user.Step 2: Click on the Services button, search for the IAM user, and click on the IAM user.<img src="https://devopsimages.in/uploads/Step_1_IAM_3c192a6840.png" alt="Click on the Services button, search for the IAM user">Step 3: On the Left sidebar click on the Users link and click on Create User buttonStep 4: Then Specify user details for the IAM user.<img src="https://devopsimages.in/uploads/Step_2_IAM_70d5affd0a.png" alt="Specify user details" width="1908" height="616">Step 5: Check on Providing user access to the AWS Management Console Checkbox and choose I want to create an IAM user<img src="https://devopsimages.in/uploads/Step_3_IAM_cca971ae93.png" alt="Providing user access to the AWS Management Console" width="1908" height="815">Step 6: The next checks are up to you and then Click on the Next Button.<img src="https://devopsimages.in/uploads/Step_4_IAM_d64eee274a.png" alt="Next Button." width="1908" height="815">Step 7: Add users to groups or you can create your own groups and select that and click on the Next Button<img src="https://devopsimages.in/uploads/Step_5_IAM_c7b5c81271.png" alt="Add users to groups " width="1908" height="890">Step 8: Now it will create an IAM User and show all details like username and password with Console Signin URL by which the user can sign in and access the AWS console.<img src="https://devopsimages.in/uploads/Step_6_IAM_268bdcc8e3.png" alt="access the AWS console." width="1908" height="890">Note: After IAM user creation you can create its Access keys and add multiple securities like Multi-factor authentication.<div class="raw-html-embed"><iframe width="100%" height="400" src="https://www.youtube.com/embed/pckcwEwoPFU?si=xrGMVrW5RUnn6KxM" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen=""></iframe>
</div><h2>Create IAM User by CLI</h2>Step 1: Create the IAM User<pre><code class="language-plaintext">aws iam create-user --user-name my-user</code></pre>Step 2: Attach a Policy to the User<pre><code class="language-plaintext">aws iam attach-user-policy --user-name my-user --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess</code></pre>Step 3: Create Access Keys(Optional)<pre><code class="language-plaintext">aws iam create-access-key --user-name my-user</code></pre>Response:<pre><code class="language-plaintext">{
 "AccessKey": {
 "UserName": "my-user",
 "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
 "Status": "Active",
 "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
 "CreateDate": "2024-06-04T15:00:00Z"
 }
}</code></pre><h2>Create IAM User by Terraform</h2>Step 1: Create the IAM user using the <code>aws_iam_user</code> resource.Step 2: Attach policies to grant the user permissions.Step 3: Optionally, create access keys if the user needs programmatic access to AWS services.<pre><code class="language-plaintext">provider "aws" {
 region = "us-west-2" # Specify your desired AWS region
}

# Step 1: Create IAM User
resource "aws_iam_user" "example_user" {
 name = "terraform-user"

 tags = {
 Name = "Terraform User"
 }
}

# Step 2: Attach IAM Policy to User
resource "aws_iam_user_policy" "example_user_policy" {
 name = "terraform-user-policy"
 user = aws_iam_user.example_user.name

 policy = jsonencode({
 Version = "2012-10-17"
 Statement = [
 {
 Action = "s3:*"
 Effect = "Allow"
 Resource = "*"
 },
 {
 Action = "ec2:Describe*"
 Effect = "Allow"
 Resource = "*"
 }
 ]
 })
}

# Step 3: Create Access Key (Optional)
resource "aws_iam_access_key" "example_user_key" {
 user = aws_iam_user.example_user.name

 # Store the access key in the Terraform output (insecure)
 depends_on = [aws_iam_user.example_user]
}

# Step 4: Output Access Key and Secret (Optional)
output "access_key" {
 value = aws_iam_access_key.example_user_key.id
}

output "secret_key" {
 value = aws_iam_access_key.example_user_key.secret
 sensitive = true
}</code></pre>Step 4: <code>terraform init</code>Step 5: <code>terraform validate</code>Step 6: <code>terraform apply</code><h2>Useful Commands for AWS IAM User</h2><figure class="table"><table><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><pre><code class="language-plaintext">aws iam create-user</code></pre></td><td>Creates a new IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam get-user</code></pre></td><td>Retrieves information about a specific IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam list-users</code></pre></td><td>Lists all IAM users in the AWS account.</td></tr><tr><td><pre><code class="language-plaintext">aws iam update-user</code></pre></td><td>Updates the name or path of an existing IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam delete-user</code></pre></td><td>Deletes an existing IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam create-login-profile</code></pre></td><td>Creates a password for the specified IAM user, giving the user the ability to access AWS services through the AWS Management Console.</td></tr><tr><td><pre><code class="language-plaintext">aws iam update-login-profile</code></pre></td><td>Updates the password for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam delete-login-profile</code></pre></td><td>Deletes the password for the specified IAM user, removing their ability to access AWS services through the AWS Management Console.</td></tr><tr><td><pre><code class="language-plaintext">aws iam list-groups-for-user</code></pre></td><td>Lists the IAM groups that the specified IAM user belongs to.</td></tr><tr><td><pre><code class="language-plaintext">aws iam add-user-to-group</code></pre></td><td>Adds the specified IAM user to the specified IAM group.</td></tr><tr><td><pre><code class="language-plaintext">aws iam remove-user-from-group</code></pre></td><td>Removes the specified IAM user from the specified IAM group.</td></tr><tr><td><pre><code class="language-plaintext">aws iam create-access-key</code></pre></td><td>Creates a new access key pair for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam list-access-keys</code></pre></td><td>Lists the access keys associated with the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam update-access-key</code></pre></td><td>Changes the status (active or inactive) of the specified access key for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam delete-access-key</code></pre></td><td>Deletes the specified access key for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam list-attached-user-policies</code></pre></td><td>Lists all managed policies attached to the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam attach-user-policy</code></pre></td><td>Attaches the specified managed policy to the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam detach-user-policy</code></pre></td><td>Detaches the specified managed policy from the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam list-user-policies</code></pre></td><td>Lists all inline policies embedded in the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam put-user-policy</code></pre></td><td>Adds or updates an inline policy document embedded in the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam get-user-policy</code></pre></td><td>Retrieves the specified inline policy document embedded in the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam delete-user-policy</code></pre></td><td>Deletes the specified inline policy document embedded in the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam list-signed-certificates</code></pre></td><td>Lists the SSL certificates associated with the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam update-signing-certificate</code></pre></td><td>Changes the status of the specified SSL certificate for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam upload-signing-certificate</code></pre></td><td>Uploads an SSL certificate for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam delete-signing-certificate</code></pre></td><td>Deletes the specified SSL certificate for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam list-service-specific-credentials</code></pre></td><td>Lists the service-specific credentials associated with the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam reset-service-specific-credential-secret</code></pre></td><td>Resets the password for the specified service-specific credential associated with the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam update-service-specific-credential</code></pre></td><td>Changes the status (active or inactive) of the specified service-specific credential for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam delete-service-specific-credential</code></pre></td><td>Deletes the specified service-specific credential for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam list-ssh-public-keys</code></pre></td><td>Lists the SSH public keys associated with the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam update-ssh-public-key</code></pre></td><td>Changes the status of the specified SSH public key for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam upload-ssh-public-key</code></pre></td><td>Uploads an SSH public key for the specified IAM user.</td></tr><tr><td><pre><code class="language-plaintext">aws iam delete-ssh-public-key</code></pre></td><td>Deletes the specified SSH public key for the specified IAM user.</td></tr></tbody></table></figure><h2>AWS - Meaning And Services To Users</h2>AWS offers IAM users, which has expanded to include identity and access management. The offering helps customers gain control over who or what they can see and use the resources and services. Admins can help create users and groups and grant them access to different resources through policies. Policy-based access control helps enable granular allowance or denial of decisions from a centralized and common point of control.&nbsp;<a href="https://devopsden.io/article/what-is-aws-and-how-it-works">Amazon Web Services (AWS)</a>, as the name suggests, is the most comprehensively functioning and broadly adopted cloud service worldwide. AWS offers more than 200 fully featured services extended from globally functional data centers.&nbsp;AWS admins can rely on policies and guidelines rather than individual configurations. This helps set up security for all functional accounts on the platform. Also, admins tend to enjoy the benefit of programmatically creating and configuring users and their accounts.&nbsp;However, users can face issues related to the basics of AWS Identity and Access Management.&nbsp;The guide will help you get started with it and use it.&nbsp;<h2>Benefits Of AWS IAM user</h2>The AWS IAM User benefits cloud users for the following reasons:&nbsp;<ol><li>There is a centralized portal for all identities and their access.</li><li>The multifactor authentication complies with the security concerns on all user accounts.</li><li>There are granular permissions through the platform policies.&nbsp;</li><li>The sharing with others option grants limited access only.</li></ol>It is a free tool; however, AWS guarantees the resources used by the user accounts.&nbsp;<h2>Setting Up AWS User Credentials In The CLI</h2>There’s another way of accessing the features of AWS IAM. You can use the AWS CLI to access the features. The AWS Command Line Interface (CLI) is another way that enables the admin to use the shell they want, or the CLI can interact with the AWS services. The options are either Linux distribution or shell. The guide covers a Bash shell running on the Ubuntu Linux distribution. The steps are as follows:&nbsp;<ol><li>You must install the AWS CLI on your system and begin using the command in the Bash terminal.&nbsp; &nbsp;</li><li>Next, you have to run the AWS configuration command present in the shell, which will help you quickly set up the access key and secret ID access that will be obtained from AWS. It is obtained after you complete the above-mentioned set of steps. Your credentials are saved in a local file.&nbsp; &nbsp;</li><li>The CLI-user programmatic access is set up after completing these steps. You can create an account for creating other users and also choose to give them policy-based access through the AWS CLI. &nbsp;</li><li>To create a user using IAM, you have to run the AWS IAM create-user command. You must ensure that you run it with a legitimate username. This command helps create a new user, and you'll also get the required details in the bash console.&nbsp; &nbsp;</li><li>You have to identify the appropriate policies to determine the user's access level. You have to pass commands to get full access to the user.&nbsp;&nbsp; &nbsp;</li><li>You have to check the user details. Also, don't forget to glance at the list of user permissions granted after following all the steps. After creating the user and attaching the apt user policy, you should not forget to verify that the AWS assigned is done correctly.&nbsp; &nbsp;</li><li>You can do a quick check by glancing at the user details. The list-users command will help you check it. Also, you can use the attached policies command to check the entire list of attached policies for any particular user account.&nbsp;</li></ol><h2>Common Issues &amp; Troubleshooting while creating &nbsp;IAM User in AWS</h2>Permission Errors:<ul><li>Issue: Access denied errors.</li><li>Solution: Ensure policies are correctly attached and the principle of least privilege is applied.</li></ul>MFA Setup Problems:<ul><li>Issue: MFA is not working.</li><li>Solution: Verify MFA device setup and synchronization with AWS.</li></ul>Credential Management:<ul><li>Issue: Lost access keys.</li><li>Solution: Rotate keys regularly and securely store them.</li></ul>Policy Conflicts:<ul><li>Issue: Overlapping policies causing unexpected behavior.</li><li>Solution: Review and simplify policies, removing redundancies.</li></ul>User Lifecycle Management:<ul><li>Issue: Users are not deactivated.</li><li>Solution: Implement a regular audit and deactivation process.</li></ul><h2>Best Practices for IAM Users</h2>Use Multi-Factor Authentication (MFA): Enable MFA for all IAM users to add an extra layer of security.Principle of Least Privilege: Grant users only necessary access.Regular Audits: Perform regular audits of IAM policies and user permissions to ensure compliance and detect any issues.Strong Password Policies: Create strong password policies, including complexity requirements and regular password changes.Monitor Activity: Use AWS CloudTrail to monitor and logs of user activity for security.<h2>Conclusion&nbsp; - IAM user</h2>The best IAM practices suggest the need for human users to use the federation with an identity provider that helps to get access to temporary credentials. It is a step that helps use the information when needed and not use the IAM users with long-term credentials. Creating an IAM user in the <a href="https://devopsden.io/article/what-is-aws-and-how-it-works">AWS</a> account is easy if you cater to the requirements and follow the steps diligently. The guide will help you successfully make and operate your user account based on the requirements.&nbsp;Read More <a href="https://devopsden.io/article/what-is-aws-and-how-it-works">https://devopsden.io/article/what-is-aws-and-how-it-works</a>Follow us on<a href="https://www.linkedin.com/company/devopsden/">https://www.linkedin.com/company/devopsden/</a>

As an Application Engineer at Xoogle Global Technologies Pvt. Ltd., I contributed to the development, testing, and deployment of web applications for various clients. I used my skills in Salesforce B2B Commerce, Web Development, and Ethical Hacking to create secure, scalable, and user-friendly solutions that met the business requirements and expectations of the customers.
                    I have a Diploma in Computer Science from Hanswahini Institute of Science and Technology, where I learned the fundamentals of programming, web design, and web applications. I also completed multiple certifications and courses in HTML, CSS, and AJAX to enhance my knowledge and proficiency in web development. I am passionate about exploring new technologies and trends in the field of internet of things (IOT), and I share my insights and experiences on my blog, Subopali. My goal is to leverage my skills and expertise to create innovative and impactful web applications that solve real-world problems and improve people's lives.

WedNov222023DSC_0244 (1) (1).jpg

I am full-stack developer and experienced Software Engineer with a demonstrated history of working in the information technology and services industry

How to Create IAM User in AWS?

Information

Contact Us

How to Create IAM User in AWS?

Subscribe to Us

Information

Contact Us