Create an IAM user without credentials

Part 84 of AWS from Zero. This lesson changes or inspects one IAM concept so the permission model stays understandable.

What we are learning

Creating an IAM user creates only the identity container. It does not automatically create credentials or grant permissions.

Before you run it

aws sts get-caller-identity
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
USER_NAME="aws-zero-learner"
GROUP_NAME="aws-zero-readers"
ROLE_NAME="aws-zero-demo-role"

IAM is global rather than regional. Use a sandbox account and a delegated administrator identity, never root access keys.

The command

aws iam create-user \
  --user-name "$USER_NAME" \
  --tags Key=Purpose,Value=aws-zero Key=Owner,Value=student

IAM writes can take a short time to propagate. Inspect the resource after every change.

Inspect the result

aws iam get-user \
  --user-name "$USER_NAME" \
  --query "User.{Name:UserName,Arn:Arn,Created:CreateDate}" \
  --output table

Read the returned ARN, path, IDs, and attachment state instead of checking only the command exit code.

One tiny variation

aws iam create-user \
  --user-name aws-zero-application \
  --path /applications/ \
  --tags Key=Purpose,Value=demo

A path changes the ARN and organizational grouping, not permission.

Common mistake

Do not create IAM users for AWS workloads when a role can provide temporary credentials. Long-term user credentials create rotation and leakage risk.

Cleanup

aws iam delete-user --user-name aws-zero-application 2>/dev/null || true
aws iam get-user --user-name "$USER_NAME"

Keep the main demo user for the next lessons; remove the optional variation user.

Next, we will learn Tag an IAM user.

Official AWS CLI reference