Create Additional Users in AWS: A Step-by-Step Guide

To create additional users in AWS, navigate to the IAM console, select "Users," and click "Create user." Assign a unique username, choose between programmatic access for API keys or console access for web login, attach specific managed policies during creation, and review the settings before finalizing. This process ensures secure, granular control over who can access your AWS resources.

Navigating the IAM Console

The Identity and Access Management (IAM) service is the central hub for managing access to your AWS account. Unlike root account credentials, which provide unrestricted access to all services and resources, IAM users allow you to delegate permissions securely. To begin creating new users, log into the AWS Management Console with an account that has administrative privileges. From the top navigation bar, search for "IAM" or locate it under the Services menu. Once inside the IAM dashboard, look for the left-hand navigation pane and select "Users." This section displays all existing IAM users associated with your account. If this is a new setup, the list may be empty. Click the prominent orange "Add users" button located near the top of the page to initiate the creation wizard. This interface is designed to guide you through the necessary steps without requiring complex JSON policy editing immediately, making it accessible even for those new to cloud security management.

Configuring User Details and Access Types

The first step in the wizard requires you to specify the username. Enter a clear, descriptive name that follows your organization's naming convention, such as john-doe-developer. Avoid using personal names alone if multiple team members share similar roles, as clarity aids in auditing later. After setting the name, you must decide how the user will interact with AWS. There are two primary options: "AWS management console access" and "Programmatic access." If the user needs to log in to the web portal to manage resources visually, check the box for console access. You can choose whether AWS generates a random password or let them set their own. For enhanced security, enabling Multi-Factor Authentication (MFA) is highly recommended at this stage. If the user requires access via command-line tools like the AWS CLI or SDKs, check the box for programmatic access. This action generates an Access Key ID and Secret Access Key. It is critical to download the CSV file containing these credentials immediately, as the secret key is only visible once during creation. Losing these keys means generating a new pair, which disrupts any automated scripts or applications relying on them.

Setting Permissions via Policies

Permissions define what actions a user can perform. Instead of attaching broad, risky policies, follow the principle of least privilege. In the "Set permissions" step, you can choose to add the user to a group, attach policies directly, or start from scratch. Creating groups is the best practice for managing teams. For example, create a group called "Developers" and attach the AmazonEC2FullAccess policy if they need to manage instances. Then, add your new user to this group. This approach simplifies future management; when a new developer joins, you simply add them to the group rather than configuring individual permissions again. If direct attachment is necessary, search for managed policies provided by AWS. Common examples include ReadOnlyAccess for auditors or AdministratorAccess for senior engineers, though the latter should be used sparingly. You can also create custom inline policies if your needs are specific. Review the selected policies carefully to ensure they align with the user's job responsibilities. Over-provisioning permissions is a common security vulnerability that can lead to accidental data deletion or unauthorized resource provisioning.

Reviewing and Finalizing Creation

Before clicking "Create user," take time to review the summary page. Verify the username, the attached policies, and the MFA status. If you enabled console access, note the sign-in URL provided in the confirmation screen. This URL is unique to your AWS account region and allows users to log in securely. For programmatic users, ensure the CSV file with credentials has been downloaded and stored in a secure location, such as a password manager. Do not share these keys via email or unsecured channels. Once satisfied, click "Create user." The system will generate the user profile and display the credentials. You can now send the sign-in instructions to the respective team member. For more information on securing your Linux instances after user access is established, see Configuring a New User on AWS EC2 with SSH (Ubuntu). Additionally, understanding how federated users access S3 buckets across accounts can help if your team structure involves cross-account collaboration, as detailed in Federated User Access to an S3 Bucket Across Multiple AWS Accounts.

Best Practices for Ongoing Management

Regularly audit IAM users and permissions. Remove inactive users and rotate access keys every 90 days. Enable CloudTrail logging to monitor all API calls made by each user, providing an audit trail for compliance and security investigations. Use IAM Access Analyzer to identify resources shared with external entities, ensuring no unintended exposure occurs. By maintaining strict controls and following these steps, you ensure that your AWS environment remains secure and scalable as your team grows.

Frequently Asked Questions

Can I delete a user who still has active access keys?

No, AWS prevents the deletion of any IAM user that has active access keys or passwords. You must first deactivate or delete all associated credentials before the user can be removed. This safeguard ensures that no running processes or applications lose authentication unexpectedly.

What is the difference between IAM users and IAM roles?

IAM users represent people or services and have long-term credentials like passwords and access keys. Roles are temporary identities assumed by users, services, or other accounts to gain permissions without storing long-term credentials. Roles are preferred for EC2 instances and cross-account access.

How do I reset a password for an existing IAM user?

Go to the IAM Users list, select the user, and click the "Security credentials" tab. Under "Sign-in credentials," click "Manage password" to force a reset or set a new one. The user will be required to change this password upon their next login if you enforce password policy rules.

Why can't my user access the AWS Management Console?

This usually happens because console access was not enabled during creation, or the user is trying to use the wrong sign-in URL. Ensure the "AWS management console access" box was checked and that the user is using the correct account-specific sign-in link provided in the IAM console.

Is it safe to use the root account for daily tasks?

It is never safe to use the root account for daily tasks due to its unrestricted power. Compromising the root account gives attackers full control over your billing and all resources. Always use IAM users with minimal required permissions for everyday operations.