Setting Up Basic Access

First PublishedFeb 24, 2026ByAtif Alam

This page walks through what to do in the AWS portal and what to do on a Mac so the AWS CLI can access your AWS resources. After this, you can run aws s3 ls, aws ec2 describe-instances, and other CLI commands against your account.

In the AWS portal (console)

All steps below use the AWS Management Console.

1. Account

• New account: Sign up at aws.amazon.com. You get a root user (the account owner). Do not use the root user for day-to-day work.
• Existing account: Sign in with your root or IAM user.

2. Secure the root user

If you have not already:

• Enable MFA on the root user: IAM → Dashboard (or Account → Security credentials) → assign an MFA device. This protects the account if the root password is compromised.
• Billing alarm (optional): Set a CloudWatch billing alarm so you get notified if spend exceeds a threshold. See Cost Management for budgets and alerts.

3. Create an IAM user for the CLI

Create a dedicated IAM user for programmatic (CLI) access instead of using the root user:

1. Go to IAM → Users → Create user.
2. Choose a name (e.g. cli-admin or dev).
3. For CLI-only use: leave “Provide user access to the AWS Management Console” unchecked. Optionally enable console access if you want this user to log in to the console too.
4. Click Next. You’ll see Set permissions with three options:

Option	When to use it
Add user to group	Best practice for teams: create or pick a group (e.g. cli-users), attach a policy to the group, add the user. New users get the same permissions by joining the group.
Copy permissions	Use when this user should have the same permissions as an existing user.
Attach policies directly	Simplest for a single user (e.g. just you): skip groups and attach a managed policy to the user. For learning, choose AdministratorAccess; for production, choose a minimal policy or use a group instead.

For one CLI user to get started quickly, choose Attach policies directly and attach AdministratorAccess (or a narrower policy). For best practice with multiple users, choose Add user to group and attach the policy to the group.

5. Complete user creation.

For users, groups, and least privilege, see IAM.

4. Create an access key

The CLI uses access keys (Access Key ID + Secret Access Key), not a password:

1. Open the new user → Security credentials tab.
2. Create access key.
3. Choose Command Line Interface (CLI) and acknowledge the warning.
4. Save the Access Key ID and Secret Access Key. The secret is shown only once; store it somewhere safe (e.g. a password manager). You will paste it into aws configure on your Mac.

5. Permissions

The user needs at least one permission to do anything useful:

• Learning / sandbox: Attach the managed policy AdministratorAccess to the user (or add the user to a group that has it). Easiest for getting started.
• Production: Prefer least privilege: create a custom policy or use a group with only the permissions the user needs. See IAM for policies and groups.

Attach: User → Permissions → Add permissions → Attach policies directly (or add to group).

---

On the Mac

1. Install the AWS CLI

Using Homebrew (recommended on Mac):

brew install awscli

If you need a specific major version: brew install awscli@2. Confirm with:

aws --version

2. Configure credentials

Run:

aws configure

You will be prompted for:

Prompt	What to enter
AWS Access Key ID	The access key ID from the console (e.g. AKIA...).
AWS Secret Access Key	The secret key you saved (shown only once in the console).
Default region name	e.g. us-east-1. Use a region close to you or your resources.
Default output format	e.g. json (or yaml, table).

This writes credentials to ~/.aws/credentials and options to ~/.aws/config. Do not commit these files to version control.

3. Verify access

Check that the CLI is using the right identity:

aws sts get-caller-identity

Example output:

{
    "UserId": "AIDAXXXXXXXXXX",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/cli-admin"
}

Then try a harmless call, e.g. list S3 buckets (empty list is fine):

aws s3 ls

If you see “Unable to locate credentials” or “Access Denied”, double-check the access key and secret, and that the IAM user has the needed permissions.

---

Multiple profiles

You can have several named profiles (e.g. personal, work, different accounts):

aws configure --profile myprofile

Use a profile by setting the environment variable or passing it to each command:

export AWS_PROFILE=myprofile
aws s3 ls

# or
aws s3 ls --profile myprofile

---

Security

• Do not commit ~/.aws/credentials or ~/.aws/config to Git. Add ~/.aws/ to .gitignore if you ever script around it.
• Rotate keys if they might have been exposed: create a new access key in the console, update aws configure, then deactivate or delete the old key.
• Delete unused keys in IAM → Users → Security credentials to reduce risk.

For more on users, MFA, and least privilege, see IAM.