The access key and secret access key are used to log into the aws management console.

In order to get your Access Key ID and Secret Access Key follow next steps:

1. Open the IAM console.
2. From the navigation menu, click Users.
3. Select your IAM user name.
4. Click User Actions, and then click Manage Access Keys.
5. Click Create Access Key.
6. Your keys will look something like this:
• Access key ID example: AKIAIOSFODNN7EXAMPLE
• Secret access key example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
7. Click Download Credentials, and store the keys in a secure location.

Table of Contents #

1. Get Access Key ID and Secret Access Key for Root Account
2. Get Access Key ID and Secret Access Key for an IAM Account
3. Deactivating and Deleting your AWS Security Credentials

Get Access Key ID and Secret Access Key for AWS #

The Access key ID and Secret Access key values are the security credentials AWS uses to verify your identity and grant or deny you access to specific resources.

In an AWS account you have:

• Root account Access Keys - they grant permissions to perform any action on any resource in the account
• IAM user Access Keys - they only allow actions that are explicitly allowed in the user's IAM policies

This article shows how to:

• generate security credentials for your Root AWS account
• generate security credentials for your IAM AWS accounts
• deactivate your security credentials if they get exposed

Get Access Key ID and Secret Access Key for Root Account #

Before you generate an Access Key Id and Secret access key for your root account be aware that these keys grant permissions to perform any action on all resources in your account.

If they get exposed, e.g. uploaded to a public GitHub repository, your account is compromised and you have to deactivate and delete the credentials immediately.

In order get an Access Key ID and Secret Access Key for your Root AWS account:

1. Open the AWS console and make sure you are logged in with your root username and password
2. In the navigation bar, click on your username and select My Security Credentials

1. In the AWS IAM credentials tab scroll down to the Access keys section and click on the Create access key button

1. Make sure to download the file with your access keys. The Secret Access key can be retrieved only upon creation
2. If your account already has credentials, which you are not using or don't have access to, it's best to deactivate and delete them

Once you close the screen that shows your Access Key ID and Secret Access Key, you will not be able to retrieve the Secret access key value again.
The solution is to delete the old credentials, generate new ones and save the file on your local file system.

Get Access Key ID and Secret Access Key for an IAM Account #

Using credentials associated with an IAM account is the recommended way to access AWS resources because you can control the permissions of an IAM user, whereas the root account permits any action on all resources in the account.

In order to get an Access Key ID and Secret Access Key for an IAM AWS account:

1. Open the IAM console
2. In the sidebar click on Users
3. If you have an existing user you would like to generate credentials for, click on the users name.

If you don't have an existing user scroll down to step 6.

1. Click on the Security Credentials tab, scroll down to the Access keys section and click on Create access key

1. Download the file with the Access key id and Secret access key. Note that the Secret Access Key can only be retrieved at the moment of creation.

2. If you don't have an IAM user you have to create one. Click on the Add users button.

3. On the user creation page:

• give your user a name
• check the Access key - Programmatic access checkbox - it enables creation of Access Key ID and Secret Access Key for the user
• if your IAM user will be used to log into the AWS console, you need to give them a password, check the Password - AWS Management Console access and set a password for the user

1. Click on the Next: Permissions button. This is the step when you have to decide what your IAM user is allowed to do. Often IAM users are used as replacement for the Root AWS account and need administrative permissions.

The permissions for your user are use case dependent, in my case I'll attach an AdministratorAccess policy to the user, which grants less permissions that the root account, but still enables you to work with all services.

1. To attach the AdministratorAccess policy, click on Attach existing policies directly and filter for AdministratorAccess in the search field.

1. Click on Next: Tags, then click on Next: Review and finally click on Create user

2. The user's Access Key ID and Secret access key will be shown on the screen. Make sure to download the file with the credentials because the Secret access key is only shown this one time

Make sure to never share your AWS Access Key ID and Secret Access key with anybody you don't trust. Always set your credentials as environment variables when used in application code and never upload your credentials to public repositories.

Deactivating and Deleting your AWS Security Credentials #

If your credentials get exposed, for instance you upload them to a remote repository with public access, you have to immediately deactivate and delete them.

If another person has access to your AWS Access Key ID and Secret Access Key, they can provision resources in your account and get you a massive bill, e.g. for bitcoin mining.

To deactivate and delete your AWS Security Credentials:

1. Open the IAM console
2. Click on the affected user
3. Click on Security Credentials and scroll down to the Access keys section

1. Click on Make inactive to deactivate your credentials and then delete them

Further Reading #

• How to Get your Account Id with AWS CLI
• How to Get your Default Profile with AWS CLI
• Manage Multiple Accounts with the AWS CLI
• Set your Default Profile's Name in AWS CLI
• How to Clear your AWS CLI Credentials
• View your AWS CLI logs in Real Time (tail)
• How to turn off the Pager in AWS CLI
• Create a Role with AWS CLI - Complete Guide
• Create a Lambda Function with AWS CLI - Complete Guide
• Invoke Lambda Functions with AWS CLI - Complete Guide
• Tag an S3 Bucket with AWS CLI
• AWS CDK Tutorial for Beginners - Step-by-Step Guide
• How to use Parameters in AWS CDK

Where is AWS access key ID and Secret access key?

What is the difference between access key and secret key in AWS?

Which entity is associated with an access key ID and Secret access key?

Where is the access key and secret key for S3 bucket?