---
title: Set up AWS IAM user
source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/iam-user-setup
---

Use this method for testing environments or when IAM roles aren't supported. Access keys are long-lived credentials that require manual rotation.

## Use cases

-   Testing and development environments
-   AWS configurations that don't support cross-account role assumption
-   Simplified authentication workflows

> #### ⚠️ CAUTION
>
> Access keys are long-lived credentials. Rotate them regularly (every 90 days) and limit permissions to only what your workflows need.

## Prerequisites

Before creating an IAM user, ensure you have:

-   An AWS account with permission to create IAM users
-   Your [New Relic account ID](https://docs.newrelic.com/docs/accounts/accounts-billing/account-structure/account-id)
-   Admin access to the [AWS IAM Console](https://console.aws.amazon.com/iam/)

## Set up the IAM user

### Create the IAM user [#create-user]

1.  Sign in to the [AWS IAM Console](https://console.aws.amazon.com/iam/)
2.  Navigate to **Users > Create user** and enter a username: `workflow-automation-user` (or your preferred name)
3.  Click **Next**
4.  On the **Set permissions** page, choose **Attach policies directly**
5.  Search for and select policies based on your workflows:
    -   For SQS: Select `AmazonSQSFullAccess`
    -   For EC2: Select `AmazonEC2ReadOnlyAccess`
    -   Or create a custom policy with limited permissions (recommended)
6.  Click **Next**, then **Create user**

### Generate access keys [#generate-keys]

1.  In the users list, select your newly created user
2.  Click the **Security credentials** tab
3.  In the **Access keys** section, choose **Create access key**
4.  Select **Application running outside AWS** and click **Next**
5.  (Optional) Add a description tag: **New Relic workflow automation**
6.  Choose **Create access key**
7.  Copy both credentials immediately:

    -   **Access key ID** (starts with `AKIA...`)
    -   **Secret access key** (shown only once)

    > #### ⚠️ IMPORTANT
    >
    > AWS displays the secret access key only once during creation. If you don't save it, you'll need to generate a new key pair.

### Store credentials securely [#store-credentials]

Never hardcode AWS credentials in workflows. Store them in New Relic's [secrets manager](https://docs.newrelic.com/docs/workflow-automation/limitations-and-faq/workflow-best-practices#secure-credentials) instead.

1.  Open the [NerdGraph GraphiQL explorer](https://one.newrelic.com/nerdgraph-graphiql)

2.  Run this mutation to store your Access Key ID (replace the placeholder values):

    ```yaml
    mutation {
      secretsManagementCreateSecret(
        scope: {type: ACCOUNT id: "YOUR_NR_ACCOUNT_ID"}
        namespace: "aws"
        key: "awsAccessKeyId"
        description: "AWS Access Key ID for workflow automation"
        value: "YOUR_AWS_ACCESS_KEY_ID"
      ) {
        key
      }
    }
    ```

3.  Run another mutation for your Secret Access Key:

    ```yaml
    mutation {
      secretsManagementCreateSecret(
        scope: {type: ACCOUNT id: "YOUR_NR_ACCOUNT_ID"}
        namespace: "aws"
        key: "awsSecretAccessKey"
        description: "AWS Secret Access Key for workflow automation"
        value: "YOUR_AWS_SECRET_ACCESS_KEY"
      ) {
        key
      }
    }
    ```

**Reference these secrets in workflows** using the syntax: `${{ :secrets:awsAccessKeyId }}`

> #### 💡 TIP
>
> Use the `namespace` field to organize secrets by environment (`aws-prod`, `aws-staging`) or team name.

## Related topics [#related-topics]

[AWS credentials overview](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials)

Compare authentication methods and choose the right one

[AWS policy examples](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/policy-examples)

Complete IAM policies for EC2, SQS, DynamoDB, and more

[AWS actions](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/actions-catalog)

Browse EC2, Lambda, S3, SQS, and other AWS actions

[Workflow best practices](https://docs.newrelic.com/docs/workflow-automation/limitations-and-faq/workflow-best-practices)

Security best practices for credentials and secrets