Create User and CLI Key

To create a user and CLI key, do the following:

1. Login to the AWS Console that contains your EJBCA Cloud Instance.

2. Select Services, IAM.

3. If a user does not already exist for access to S3, create one by clicking Users.

4. Click Add User and add a username for this user, for example EJBCAS3CRLPublisher.

5. Select the Access type Programmatic access to allow this user to use the CLI (as well as other APIs) only.

6. Click Next: Permissions and select Attach existing policies directly.

7. In the Filter policies search box, enter S3 in the search field and then select AmazonS3FullAccess. If required, you may create more restricted access.

8. Click Next: Tags.

9. Add any optional tags and then click Next: Review.

10. Click Create user.

11. The confirmation screen shows successful user creation. Note the Access key ID and Secret access key. Download the CSV file that contains these items or store them in a secure place such as KeyPass or LastPass. These credentials will be needed in the AWS CLI Configuration.

12. Click Close.

Optional: Create a Role for the User

To optionally create a role for the user, do the following:

1. If a role does not already exist for access to S3, create one by clicking Roles > Create Role.

2. Select S3 under the section Choose the service that will use this role, and then click Next: Permissions.

3. In the Filter policies search box, type S3 in the search field and then select AmazonS3FullAccess. If required, you may create more restricted access.

4. Click Next: Tags.

5. Add any optional tags and click Next: Review.

6. In Role name, enter a name for the role, for example, S3FullAccessForAWSCLI.

7. Click Create Role and confirm that a message is shown saying that the role has been created.

8. You can then attach this role to a user instead of a policy.

Next, Configure the AWS CLI.