Setting Up AWS Credentials for Terraform

Welcome — this guide walks you step‑by‑step through creating an AWS IAM user and credentials so Terraform can authenticate and manage resources in your AWS account. You’ll learn how to create a scoped IAM user, generate programmatic access keys, and configure those credentials locally for Terraform use. What you’ll do

Step	Purpose
Create an IAM user	A dedicated user for Terraform to avoid using personal credentials
Attach a scoped policy	Limit permissions (this guide uses `AmazonVPCFullAccess` for the exercises)
Create programmatic access keys	Generate Access Key ID and Secret Access Key for Terraform
Configure credentials locally	Use environment variables or the AWS shared credentials file so Terraform can read them

Create the IAM user
Sign in to the AWS Management Console and open the IAM console (search for “IAM” at the top).
In IAM, choose Users, then click Create user.
Enter a username (for example: terraform).
For Access type, enable Programmatic access (this generates the Access Key ID and Secret Access Key Terraform will use).

A screenshot of the AWS IAM "Create user" console on the "Specify user details" step, with the username field filled as "terraform." The page shows options for providing console access and a note about generating programmatic access keys, with Cancel and Next buttons at the bottom.

Attach a policy

For these exercises, attach the AmazonVPCFullAccess managed policy to limit permissions to the VPC-related resources used in the examples.
If you prefer to experiment with fewer restrictions, you may attach AdministratorAccess temporarily — but follow least-privilege principles in real projects and production.

Scroll to the bottom and complete the user creation.

A screenshot of the AWS Identity and Access Management (IAM) Users page showing a list of IAM users. A green banner at the top reads "User created successfully" and controls like Create user, Delete, and Search are visible.

Verify permissions

Click the newly created user and open the Permissions tab.
Confirm that the AmazonVPCFullAccess policy (or whichever policy you attached) is listed.

A screenshot of the AWS Identity and Access Management (IAM) console showing the "Permissions" tab for a user (terraform) with the AmazonVPCFullAccess policy attached. The page displays access key options, permissions policies, and other IAM navigation items.

Create access keys
Open the Security credentials tab for the user.
Scroll to the Access keys section and choose Create access key.
Confirm any prompts and generate the keys.
Copy the Access Key ID and the Secret Access Key — you’ll need them to configure Terraform locally.

A screenshot of the AWS Identity and Access Management (IAM) user security credentials page showing sections for Multi-Factor Authentication (MFA), access keys, and SSH public keys. The page shows no MFA devices or access keys configured and includes buttons to assign MFA, create access keys, and upload SSH public keys.

Important: copy the Secret Access Key now — it is shown only once. If you lose it you must recreate the access key pair.

Configure credentials for Terraform Terraform (via the AWS provider) uses the AWS SDK default credential chain. Common credential sources (in priority order) include:

Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_DEFAULT_REGION)
AWS shared credentials/config files (~/.aws/credentials and ~/.aws/config)
Instance profile / IAM role (EC2, ECS tasks, Lambda)
Container credentials or other platform-specific providers

For local development and short-lived tasks, the quickest options are environment variables or the AWS CLI (aws configure). For automation, use IAM roles or short-term credentials (STS). Example Terraform configuration Save the following HCL in a .tf file in your working directory (for example main.tf). This sample creates two VPCs and one subnet:

resource "aws_vpc" "production" {
  cidr_block = "10.0.0.0/16"

  tags = {
    Name = "production"
  }
}

resource "aws_vpc" "dev" {
  cidr_block = "10.10.0.0/16"

  tags = {
    Name = "dev"
  }
}

resource "aws_subnet" "workloads" {
  vpc_id     = aws_vpc.production.id
  cidr_block = "10.0.1.0/24"

  tags = {
    Name = "workloads"
  }
}

How to provide credentials Set environment variables (macOS / Linux) Replace the placeholder values with your actual keys and preferred region. Run these in the same terminal session where you will run Terraform:

export AWS_ACCESS_KEY_ID="YOUR_ACCESS_KEY_ID"
export AWS_SECRET_ACCESS_KEY="YOUR_SECRET_ACCESS_KEY"
export AWS_DEFAULT_REGION="us-east-1"

Notes:

Use the appropriate AWS region for your resources (us-east-1, us-west-2, etc.).
These exports persist only for the active shell session. To make them persistent, add them to your shell profile (e.g., ~/.bashrc, ~/.zshrc).

Set environment variables (Windows PowerShell) In PowerShell (not Bash), run:

$Env:AWS_ACCESS_KEY_ID = "YOUR_ACCESS_KEY_ID"
$Env:AWS_SECRET_ACCESS_KEY = "YOUR_SECRET_ACCESS_KEY"
$Env:AWS_DEFAULT_REGION = "us-east-1"

Alternative: use the AWS CLI (recommended for most local workflows) Run the interactive setup which stores credentials in the shared credentials file:

aws configure

This prompts for:

Access Key ID
Secret Access Key
Default region
Default output format

It writes values to ~/.aws/credentials and ~/.aws/config which Terraform will automatically read. Credential configuration options (quick reference)

Method	When to use	Notes
Environment variables	Quick sessions, CI steps	Good for ephemeral work; not persistent across terminal sessions
AWS shared credentials file	Local development, multiple profiles	Works well with `aws configure` and named profiles
IAM role / instance profile	Production EC2/ECS/Lambda	Best practice for automation and long-running services
AWS CLI SSO / federated creds	Organizations using SSO	Follow your organization’s SSO flow

Security best practices

Do not leave access keys lying around. Delete keys after finishing exercises or rotate them regularly. For long-lived automation, prefer IAM roles, instance profiles, or short-term STS credentials.

For repeated use, prefer the AWS shared credentials file or IAM roles. Use least-privilege policies (for example AmazonVPCFullAccess for VPC-only exercises) instead of AdministratorAccess.

Run Terraform

In the directory containing your .tf files, initialize Terraform and create a plan:

terraform init
terraform plan

If Terraform reports no configuration files found, verify you are in the directory with your .tf files. Troubleshooting tip

If Terraform fails to authenticate, verify:
- Environment variables are set in the same shell session.
- ~/.aws/credentials has the correct keys if using the AWS CLI.
- The user has the required IAM policy attached.

References and further reading

AWS IAM documentation: https://docs.aws.amazon.com/iam/
AWS CLI configure documentation: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html
Terraform AWS provider: https://registry.terraform.io/providers/hashicorp/aws/latest

That’s it — once credentials are configured, Terraform can access your AWS account using the permissions granted to the IAM user you created.

Course Introduction

Preparing Your Environment

Terraform Foundations

The Core Terraform Workflow

Terraform CLI

Terraform File Structure and Organization

Terraform Configuration - Fundamentals

Understading and Managing Terraform State

Marking Code Reusable

Refactoring Terraform State

Terraform Modules

Managing Resource Behavior and Dependencies

Securing Terraform Configurations

Terraform Troubleshooting

HCP Terraform

Setting Up AWS Credentials for Terraform

Watch Video