# Use `CreateAccessKey` with an Amazon SDK or CLI
The following code examples show how to use `CreateAccessKey`.
Action examples are code excerpts from larger programs and must be run in context. You can see this action in context in the following code examples:
+ [Learn the basics](iam_example_iam_Scenario_CreateUserAssumeRole_section.md)
+ [Create read-only and read-write users](iam_example_iam_Scenario_UserPolicies_section.md)
+ [Manage access keys](iam_example_iam_Scenario_ManageAccessKeys_section.md)
------
#### [ .NET ]
**Amazon SDK for .NET**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/dotnetv3/IAM#code-examples).
```
///
/// Create an IAM access key for a user.
///
/// The username for which to create the IAM access
/// key.
/// The AccessKey.
public async Task CreateAccessKeyAsync(string userName)
{
var response = await _IAMService.CreateAccessKeyAsync(new CreateAccessKeyRequest
{
UserName = userName,
});
return response.AccessKey;
}
```
+ For API details, see [CreateAccessKey](https://docs.amazonaws.cn/goto/DotNetSDKV3/iam-2010-05-08/CreateAccessKey) in *Amazon SDK for .NET API Reference*.
------
#### [ Bash ]
**Amazon CLI with Bash script**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/aws-cli/bash-linux/iam#code-examples).
```
###############################################################################
# function errecho
#
# This function outputs everything sent to it to STDERR (standard error output).
###############################################################################
function errecho() {
printf "%s\n" "$*" 1>&2
}
###############################################################################
# function iam_create_user_access_key
#
# This function creates an IAM access key for the specified user.
#
# Parameters:
# -u user_name -- The name of the IAM user.
# [-f file_name] -- The optional file name for the access key output.
#
# Returns:
# [access_key_id access_key_secret]
# And:
# 0 - If successful.
# 1 - If it fails.
###############################################################################
function iam_create_user_access_key() {
local user_name file_name response
local option OPTARG # Required to use getopts command in a function.
# bashsupport disable=BP5008
function usage() {
echo "function iam_create_user_access_key"
echo "Creates an AWS Identity and Access Management (IAM) key pair."
echo " -u user_name The name of the IAM user."
echo " [-f file_name] Optional file name for the access key output."
echo ""
}
# Retrieve the calling parameters.
while getopts "u:f:h" option; do
case "${option}" in
u) user_name="${OPTARG}" ;;
f) file_name="${OPTARG}" ;;
h)
usage
return 0
;;
\?)
echo "Invalid parameter"
usage
return 1
;;
esac
done
export OPTIND=1
if [[ -z "$user_name" ]]; then
errecho "ERROR: You must provide a username with the -u parameter."
usage
return 1
fi
response=$(aws iam create-access-key \
--user-name "$user_name" \
--output text)
local error_code=${?}
if [[ $error_code -ne 0 ]]; then
aws_cli_error_log $error_code
errecho "ERROR: AWS reports create-access-key operation failed.$response"
return 1
fi
if [[ -n "$file_name" ]]; then
echo "$response" >"$file_name"
fi
local key_id key_secret
# shellcheck disable=SC2086
key_id=$(echo $response | cut -f 2 -d ' ')
# shellcheck disable=SC2086
key_secret=$(echo $response | cut -f 4 -d ' ')
echo "$key_id $key_secret"
return 0
}
```
+ For API details, see [CreateAccessKey](https://docs.amazonaws.cn/goto/aws-cli/iam-2010-05-08/CreateAccessKey) in *Amazon CLI Command Reference*.
------
#### [ C\$1\$1 ]
**SDK for C\$1\$1**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/cpp/example_code/iam#code-examples).
```
Aws::String AwsDoc::IAM::createAccessKey(const Aws::String &userName,
const Aws::Client::ClientConfiguration &clientConfig) {
Aws::IAM::IAMClient iam(clientConfig);
Aws::IAM::Model::CreateAccessKeyRequest request;
request.SetUserName(userName);
Aws::String result;
Aws::IAM::Model::CreateAccessKeyOutcome outcome = iam.CreateAccessKey(request);
if (!outcome.IsSuccess()) {
std::cerr << "Error creating access key for IAM user " << userName
<< ":" << outcome.GetError().GetMessage() << std::endl;
}
else {
const auto &accessKey = outcome.GetResult().GetAccessKey();
std::cout << "Successfully created access key for IAM user " <<
userName << std::endl << " aws_access_key_id = " <<
accessKey.GetAccessKeyId() << std::endl <<
" aws_secret_access_key = " << accessKey.GetSecretAccessKey() <<
std::endl;
result = accessKey.GetAccessKeyId();
}
return result;
}
```
+ For API details, see [CreateAccessKey](https://docs.amazonaws.cn/goto/SdkForCpp/iam-2010-05-08/CreateAccessKey) in *Amazon SDK for C\$1\$1 API Reference*.
------
#### [ CLI ]
**Amazon CLI**
**To create an access key for an IAM user**
The following `create-access-key` command creates an access key (access key ID and secret access key) for the IAM user named `Bob`.
```
aws iam create-access-key \
--user-name Bob
```
Output:
```
{
"AccessKey": {
"UserName": "Bob",
"Status": "Active",
"CreateDate": "2015-03-09T18:39:23.411Z",
"SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
"AccessKeyId": "AKIAIOSFODNN7EXAMPLE"
}
}
```
Store the secret access key in a secure location. If it is lost, it cannot be recovered, and you must create a new access key.
For more information, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) in the *Amazon IAM User Guide*.
+ For API details, see [CreateAccessKey](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/create-access-key.html) in *Amazon CLI Command Reference*.
------
#### [ Go ]
**SDK for Go V2**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/gov2/iam#code-examples).
```
import (
"context"
"encoding/json"
"errors"
"log"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/iam"
"github.com/aws/aws-sdk-go-v2/service/iam/types"
"github.com/aws/smithy-go"
)
// UserWrapper encapsulates user actions used in the examples.
// It contains an IAM service client that is used to perform user actions.
type UserWrapper struct {
IamClient *iam.Client
}
// CreateAccessKeyPair creates an access key for a user. The returned access key contains
// the ID and secret credentials needed to use the key.
func (wrapper UserWrapper) CreateAccessKeyPair(ctx context.Context, userName string) (*types.AccessKey, error) {
var key *types.AccessKey
result, err := wrapper.IamClient.CreateAccessKey(ctx, &iam.CreateAccessKeyInput{
UserName: aws.String(userName)})
if err != nil {
log.Printf("Couldn't create access key pair for user %v. Here's why: %v\n", userName, err)
} else {
key = result.AccessKey
}
return key, err
}
```
+ For API details, see [CreateAccessKey](https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/iam#Client.CreateAccessKey) in *Amazon SDK for Go API Reference*.
------
#### [ Java ]
**SDK for Java 2.x**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javav2/example_code/iam#code-examples).
```
import software.amazon.awssdk.services.iam.model.CreateAccessKeyRequest;
import software.amazon.awssdk.services.iam.model.CreateAccessKeyResponse;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.iam.IamClient;
import software.amazon.awssdk.services.iam.model.IamException;
/**
* Before running this Java V2 code example, set up your development
* environment, including your credentials.
*
* For more information, see the following documentation topic:
*
* https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/get-started.html
*/
public class CreateAccessKey {
public static void main(String[] args) {
final String usage = """
Usage:
\s
Where:
user - An AWS IAM user that you can obtain from the AWS Management Console.
""";
if (args.length != 1) {
System.out.println(usage);
System.exit(1);
}
String user = args[0];
Region region = Region.AWS_GLOBAL;
IamClient iam = IamClient.builder()
.region(region)
.build();
String keyId = createIAMAccessKey(iam, user);
System.out.println("The Key Id is " + keyId);
iam.close();
}
public static String createIAMAccessKey(IamClient iam, String user) {
try {
CreateAccessKeyRequest request = CreateAccessKeyRequest.builder()
.userName(user)
.build();
CreateAccessKeyResponse response = iam.createAccessKey(request);
return response.accessKey().accessKeyId();
} catch (IamException e) {
System.err.println(e.awsErrorDetails().errorMessage());
System.exit(1);
}
return "";
}
}
```
+ For API details, see [CreateAccessKey](https://docs.amazonaws.cn/goto/SdkForJavaV2/iam-2010-05-08/CreateAccessKey) in *Amazon SDK for Java 2.x API Reference*.
------
#### [ JavaScript ]
**SDK for JavaScript (v3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascriptv3/example_code/iam#code-examples).
Create the access key.
```
import { CreateAccessKeyCommand, IAMClient } from "@aws-sdk/client-iam";
const client = new IAMClient({});
/**
*
* @param {string} userName
*/
export const createAccessKey = (userName) => {
const command = new CreateAccessKeyCommand({ UserName: userName });
return client.send(command);
};
```
+ For more information, see [Amazon SDK for JavaScript Developer Guide](https://docs.amazonaws.cn/sdk-for-javascript/v3/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-creating).
+ For API details, see [CreateAccessKey](https://docs.amazonaws.cn/AWSJavaScriptSDK/v3/latest/client/iam/command/CreateAccessKeyCommand) in *Amazon SDK for JavaScript API Reference*.
**SDK for JavaScript (v2)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/javascript/example_code/iam#code-examples).
```
// Load the AWS SDK for Node.js
var AWS = require("aws-sdk");
// Set the region
AWS.config.update({ region: "REGION" });
// Create the IAM service object
var iam = new AWS.IAM({ apiVersion: "2010-05-08" });
iam.createAccessKey({ UserName: "IAM_USER_NAME" }, function (err, data) {
if (err) {
console.log("Error", err);
} else {
console.log("Success", data.AccessKey);
}
});
```
+ For more information, see [Amazon SDK for JavaScript Developer Guide](https://docs.amazonaws.cn/sdk-for-javascript/v2/developer-guide/iam-examples-managing-access-keys.html#iam-examples-managing-access-keys-creating).
+ For API details, see [CreateAccessKey](https://docs.amazonaws.cn/goto/AWSJavaScriptSDK/iam-2010-05-08/CreateAccessKey) in *Amazon SDK for JavaScript API Reference*.
------
#### [ Kotlin ]
**SDK for Kotlin**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/kotlin/services/iam#code-examples).
```
suspend fun createIAMAccessKey(user: String?): String {
val request =
CreateAccessKeyRequest {
userName = user
}
IamClient.fromEnvironment { region = "AWS_GLOBAL" }.use { iamClient ->
val response = iamClient.createAccessKey(request)
return response.accessKey?.accessKeyId.toString()
}
}
```
+ For API details, see [CreateAccessKey](https://sdk.amazonaws.com/kotlin/api/latest/index.html) in *Amazon SDK for Kotlin API reference*.
------
#### [ PowerShell ]
**Tools for PowerShell V4**
**Example 1: This example creates a new access key and secret access key pair and assigns it to the user `David`. Ensure that you save the `AccessKeyId` and `SecretAccessKey` values to a file because this is the only time you can obtain the `SecretAccessKey`. You cannot retrieve it later. If you lose the secret key, you must create a new access key pair.**
```
New-IAMAccessKey -UserName David
```
**Output:**
```
AccessKeyId : AKIAIOSFODNN7EXAMPLE
CreateDate : 4/13/2015 1:00:42 PM
SecretAccessKey : wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Status : Active
UserName : David
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/powershell/v4/reference) in *Amazon Tools for PowerShell Cmdlet Reference (V4)*.
**Tools for PowerShell V5**
**Example 1: This example creates a new access key and secret access key pair and assigns it to the user `David`. Ensure that you save the `AccessKeyId` and `SecretAccessKey` values to a file because this is the only time you can obtain the `SecretAccessKey`. You cannot retrieve it later. If you lose the secret key, you must create a new access key pair.**
```
New-IAMAccessKey -UserName David
```
**Output:**
```
AccessKeyId : AKIAIOSFODNN7EXAMPLE
CreateDate : 4/13/2015 1:00:42 PM
SecretAccessKey : wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Status : Active
UserName : David
```
+ For API details, see [CreateAccessKey](https://docs.aws.amazon.com/powershell/v5/reference) in *Amazon Tools for PowerShell Cmdlet Reference (V5)*.
------
#### [ Python ]
**SDK for Python (Boto3)**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/python/example_code/iam#code-examples).
```
def create_key(user_name):
"""
Creates an access key for the specified user. Each user can have a
maximum of two keys.
:param user_name: The name of the user.
:return: The created access key.
"""
try:
key_pair = iam.User(user_name).create_access_key_pair()
logger.info(
"Created access key pair for %s. Key ID is %s.",
key_pair.user_name,
key_pair.id,
)
except ClientError:
logger.exception("Couldn't create access key pair for %s.", user_name)
raise
else:
return key_pair
```
+ For API details, see [CreateAccessKey](https://docs.amazonaws.cn/goto/boto3/iam-2010-05-08/CreateAccessKey) in *Amazon SDK for Python (Boto3) API Reference*.
------
#### [ Ruby ]
**SDK for Ruby**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/ruby/example_code/iam#code-examples).
This example module lists, creates, deactivates, and deletes access keys.
```
# Manages access keys for IAM users
class AccessKeyManager
def initialize(iam_client, logger: Logger.new($stdout))
@iam_client = iam_client
@logger = logger
@logger.progname = 'AccessKeyManager'
end
# Lists access keys for a user
#
# @param user_name [String] The name of the user.
def list_access_keys(user_name)
response = @iam_client.list_access_keys(user_name: user_name)
if response.access_key_metadata.empty?
@logger.info("No access keys found for user '#{user_name}'.")
else
response.access_key_metadata.map(&:access_key_id)
end
rescue Aws::IAM::Errors::NoSuchEntity
@logger.error("Error listing access keys: cannot find user '#{user_name}'.")
[]
rescue StandardError => e
@logger.error("Error listing access keys: #{e.message}")
[]
end
# Creates an access key for a user
#
# @param user_name [String] The name of the user.
# @return [Boolean]
def create_access_key(user_name)
response = @iam_client.create_access_key(user_name: user_name)
access_key = response.access_key
@logger.info("Access key created for user '#{user_name}': #{access_key.access_key_id}")
access_key
rescue Aws::IAM::Errors::LimitExceeded
@logger.error('Error creating access key: limit exceeded. Cannot create more.')
nil
rescue StandardError => e
@logger.error("Error creating access key: #{e.message}")
nil
end
# Deactivates an access key
#
# @param user_name [String] The name of the user.
# @param access_key_id [String] The ID for the access key.
# @return [Boolean]
def deactivate_access_key(user_name, access_key_id)
@iam_client.update_access_key(
user_name: user_name,
access_key_id: access_key_id,
status: 'Inactive'
)
true
rescue StandardError => e
@logger.error("Error deactivating access key: #{e.message}")
false
end
# Deletes an access key
#
# @param user_name [String] The name of the user.
# @param access_key_id [String] The ID for the access key.
# @return [Boolean]
def delete_access_key(user_name, access_key_id)
@iam_client.delete_access_key(
user_name: user_name,
access_key_id: access_key_id
)
true
rescue StandardError => e
@logger.error("Error deleting access key: #{e.message}")
false
end
end
```
+ For API details, see [CreateAccessKey](https://docs.amazonaws.cn/goto/SdkForRubyV3/iam-2010-05-08/CreateAccessKey) in *Amazon SDK for Ruby API Reference*.
------
#### [ Rust ]
**SDK for Rust**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/rustv1/examples/iam#code-examples).
```
pub async fn create_access_key(client: &iamClient, user_name: &str) -> Result {
let mut tries: i32 = 0;
let max_tries: i32 = 10;
let response: Result> = loop {
match client.create_access_key().user_name(user_name).send().await {
Ok(inner_response) => {
break Ok(inner_response);
}
Err(e) => {
tries += 1;
if tries > max_tries {
break Err(e);
}
sleep(Duration::from_secs(2)).await;
}
}
};
Ok(response.unwrap().access_key.unwrap())
}
```
+ For API details, see [CreateAccessKey](https://docs.rs/aws-sdk-iam/latest/aws_sdk_iam/client/struct.Client.html#method.create_access_key) in *Amazon SDK for Rust API reference*.
------
#### [ SAP ABAP ]
**SDK for SAP ABAP**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/sap-abap/services/iam#code-examples).
```
TRY.
oo_result = lo_iam->createaccesskey(
iv_username = iv_user_name ).
MESSAGE 'Access key created successfully.' TYPE 'I'.
CATCH /aws1/cx_iamnosuchentityex.
MESSAGE 'User does not exist.' TYPE 'E'.
CATCH /aws1/cx_iamlimitexceededex.
MESSAGE 'Maximum number of access keys reached.' TYPE 'E'.
ENDTRY.
```
+ For API details, see [CreateAccessKey](https://docs.amazonaws.cn/sdk-for-sap-abap/v1/api/latest/index.html) in *Amazon SDK for SAP ABAP API reference*.
------
#### [ Swift ]
**SDK for Swift**
There's more on GitHub. Find the complete example and learn how to set up and run in the [Amazon Code Examples Repository](https://github.com/awsdocs/aws-doc-sdk-examples/tree/main/swift/example_code/iam#code-examples).
```
import AWSIAM
import AWSS3
public func createAccessKey(userName: String) async throws -> IAMClientTypes.AccessKey {
let input = CreateAccessKeyInput(
userName: userName
)
do {
let output = try await iamClient.createAccessKey(input: input)
guard let accessKey = output.accessKey else {
throw ServiceHandlerError.keyError
}
return accessKey
} catch {
print("ERROR: createAccessKey:", dump(error))
throw error
}
}
```
+ For API details, see [CreateAccessKey](https://sdk.amazonaws.com/swift/api/awsiam/latest/documentation/awsiam/iamclient/createaccesskey(input:)) in *Amazon SDK for Swift API reference*.
------
For a complete list of Amazon SDK developer guides and code examples, see [Using this service with an Amazon SDK](sdk-general-information-section.md). This topic also includes information about getting started and details about previous SDK versions.