**This documentation is for Version 1 of the AWS CLI only.**

We announced the upcoming end-of-support for the AWS CLI version 1. We recommend that you migrate to the AWS CLI version 2. For dates, additional details, and information on how to migrate, see the [announcement](https://aws.amazon.com/blogs/developer/cli-v1-maintenance-mode-announcement/). For documentation related to Version 2 of the AWS CLI, see the [Version 2 User Guide](https://docs.aws.amazon.com/cli/latest/userguide/).

# Authenticating using IAM user credentials for the AWS CLI
<a name="cli-authentication-user"></a>

**Warning**  
To avoid security risks, don't use IAM users for authentication when developing purpose-built software or working with real data. Instead, use federation with an identity provider such as [AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html).

This section explains how to configure basic settings with an IAM user. These include your security credentials using the `config` and `credentials` files. 

**Contents**
+ [Step 1: Create your IAM user](#cli-authentication-user-create)
+ [Step 2: Get your access keys](#cli-authentication-user-get)
+ [Step 3: Configure the AWS CLI](#cli-authentication-user-configure.title)
  + [Using `aws configure`](#cli-authentication-user-configure-wizard)

## Step 1: Create your IAM user
<a name="cli-authentication-user-create"></a>

Create your IAM user by following the [Creating IAM users (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html#id_users_create_console) procedure in the *IAM User Guide*. 
+ For **Permission options**, choose **Attach policies directly** for how you want to assign permissions to this user.
+ Most "Getting Started" SDK tutorials use the Amazon S3 service as an example. To provide your application with full access to Amazon S3, select the `AmazonS3FullAccess` policy to attach to this user.

## Step 2: Get your access keys
<a name="cli-authentication-user-get"></a>

1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/).

1. In the navigation pane of the IAM console, select **Users** and then select the **`User name`** of the user that you created previously. 

1. On the user's page, select the **Security credentials** page. Then, under **Access keys**, select **Create access key**.

1.  For **Create access key Step 1**, choose **Command Line Interface (CLI)**.

1. For **Create access key Step 2**, enter an optional tag and select **Next**. 

1. For **Create access key Step 3**, select **Download .csv file** to save a `.csv` file with your IAM user's access key and secret access key. You need this information for later.

1. Select Done.

## Step 3: Configure the AWS CLI
<a name="cli-authentication-user-configure.title"></a>

For general use, the AWS CLI needs the following pieces of information:
+ Access key ID
+ Secret access key
+ AWS Region
+ Output format

The AWS CLI stores this information in a *profile* (a collection of settings) named `default` in the `credentials` file. By default, the information in this profile is used when you run an AWS CLI command that doesn't explicitly specify a profile to use. For more information on the `credentials` file, see [Configuration and credential file settings in the AWS CLI](cli-configure-files.md).

To configure the AWS CLI, use one of the following procedures:

**Topics**
+ [Using `aws configure`](#cli-authentication-user-configure-wizard)

### Using `aws configure`
<a name="cli-authentication-user-configure-wizard"></a>

For general use, the `aws configure` command is the fastest way to set up your AWS CLI installation. This configure wizard prompts you for each piece of information you need to get started. Unless otherwise specified by using the `--profile` option, the AWS CLI stores this information in the `default` profile.

The following example configures a `default` profile using sample values. Replace them with your own values as described in the following sections.

```
$ aws configure
AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-west-2
Default output format [None]: json
```

The following example configures a profile named `userprod` using sample values. Replace them with your own values as described in the following sections.

```
$ aws configure --profile userprod
AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-west-2
Default output format [None]: json
```