Creating an AWS Account for Programmatic Access
Tags: aws, iam, cli
Published: 2022-11-07 10:00:00

---
title: Creating an AWS Account for Programmatic Access
tags: aws, iam, cli
published_at: 20221107T10:00Z
canonical_url: https://ladvien.com/lets-setup-aws-accounts
main_image: https://ladvien.com/raw_images/lets-build-data-warehouse-70s.png
series: Let's Build a Data Warehouse
published: true
---

Before we can begin creating infrastructure through tools like Terraform and the Serverless Framework, we need to set up an AWS account and credentials for accessing AWS through the [AWS CLI](https://aws.amazon.com/cli/). The AWS CLI will allow us to easily set up programmatic access to AWS, which is necessary to use Terraform and the Serverless Framework to rapidly deploy needed infrastructure.

## Creating an AWS Account
Before beginning into AWS, let me warn you: Stuff can get expensive. Please exercise great caution, as leaving the wrong resource on can lead to a heft bill overnight.

To create an account visit: 
* [Instructions for Creating an AWS Account](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html)

Once done, we should have an AWS "root" account. It is best practice to enable multi-factor authentication (MFA) on this account. If someone can access the `root` account, there's little they can't do. 

Another good practice is to create a separate AWS user for programmatic access, we should create a separate user to act as our administration account.

In the end, our IAM dashboard should look like:
![aws-iam-dashboard-security-recommendations-met](https://ladvien.com/raw_images/data-warehouse/iam-root-account-safe.png)

## Enable MFA on Root Account
Let's create an "admin" account. Go to your account name and then "Settings". Enable MFA.
![aws-root-account-mfa](https://ladvien.com/raw_images/data-warehouse/aws-root-account-mfa.png)

## Create an Admin User
In the search bar above look for "IAM." This is AWS' users and permissions service. Let's make an administrative user; we will add this user's API credentials to our local system for use by Terraform and Serverless Framework.

![aws-iam-service](https://ladvien.com/raw_images/data-warehouse/aws-iam.png)

Now go to "User":

![aws-iam-create-user](https://ladvien.com/raw_images/data-warehouse/create-aws-user.png)

Enter "admin" as the user name and select the "Access key - Programmatic access" option. If you would like to log in to the account from the web, then also select the "Password - AWS Management Console access" option.

![aws-admin-account-creation-add-user](https://ladvien.com/raw_images/data-warehouse/aws-admin-account-2.png)

Select "Attach existing policies directly":
![aws-admin-account-attaching-policy](https://ladvien.com/raw_images/data-warehouse/aws-admin-account-4.png)

Skip or add tags, review the new user, then create it.
![aws-admin-account-getting-credentials](https://ladvien.com/raw_images/data-warehouse/aws-admin-account-5.png)

My recommendation is to use a password manager like [1password](https://1password.com/) or [Lastpass](https://www.lastpass.com/) to store your "Access Key ID" and "Secret access key" as we will be using them in the next step. 

Also, it is a good practice to set up MFA on the `admin` user as well.

## Setting Up the AWS CLI
Next, we need to install the AWS CLI. I usually only use the actual AWS CLI tool to manage credentials or spot-check infrastructure, but both are handy, so worth installing it.

* [AWS' Instructions for Installing AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html)

After installing open up a terminal. Type the following to ensure it's installed properly.
```sh
aws --version
```

You should get an output like:
```
aws-cli/2.8.2 Python/3.10.8 Darwin/21.6.0 source/arm64 prompt/off
```

If you have any trouble, ping me in the comments.

## Set Up AWS Programmatic Credentials
Still at the terminal, type:
```
aws configure
```

You will be prompted with questions similar to:
```sh
AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-west-2
Default output format [None]: 
```
`AWS Access Key ID` and `AWS Secret Access Key` should be retrieved from your password manager.

`Default region name` and `Default output format` will depend on you. 

For the sake of this article series, I'll be conducting all work in `us-west-2`. Do know, many services and resources are localized to the region, so if you create infrastructure in `us-west-2`, it will not be visible if you are in the UI but under the region `us-west-1`. Also, identical resources in different regions will have different IDs, or Amazon Resource Numbers (ARNs).

![aws-ui-regions-menu](https://ladvien.com/raw_images/data-warehouse/aws-regions-in-ui.png)

If you've any trouble, you might review AWS instructions on programmatic access credential setup:
* [Config and credential file settings](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html)

## What's Next
Next, we are going to set up Terraform and Terragrunt so we can easily deploy and manage the needed infrastructure for our data warehouse.