How IAM users sign in to AWS – AWS Identity and Access Management

To sign in to the AWS Management Console as an IAM user, you must enter your user ID or account alias. When an administrator created an IAM user in the console and signed in, they should have been sent sign-in credentials, such as the URL of the account sign-in page that includes the username and account ID or account alias.

https://My_AWS_Account_ID.signin.aws.amazon.com/console/

You can also manually enter your account ID or account alias by signing in with the following general sign-in endpoint:

https://console.aws.amazon.com/

For your convenience, the AWS sign-in page uses a browser cookie to remember your IAM username and account information. The next time a user navigates to any page, the AWS Management Console uses a cookie to redirect the user to the account sign-in page.

You can only access AWS resources that an administrator specifies in the policy associated with your IAM user ID. To interact with the console, users must have permission to perform the actions that the console performs, such as listing and creating AWS resources. For more information, seeAWS resource access management” and “IAM identity-based policy example”.

Logging sign-in details with CloudTrail

If you enable CloudTrail to record sign-in events in your logs, you should be aware of how CloudTrail chooses where to log events.

For more information about CloudTrail and IAM, seeLogging IAM events with CloudTrail”.

If your users require programmatic access to operate your account, you can create an access key pair (access key ID and secret access key) for each user. However, there are more secure alternatives to consider before creating access keys for your users. For more information, seeAWS general reference“of”Considerations and alternatives for long-term access keys”.

Other resources

For more information about AWS Sign In, see the following resources: