Create an IAM user for CDK

AWS recommends never using root credentials for day-to-day work — root can do literally anything in the account, including things a compromised CLI credential shouldn't be able to touch, like closing the account itself. CDK needs its own, narrower identity.

Create the user

Sign in to the AWS Console with your root credentials, then:

1. Search for IAM and open the IAM dashboard.
2. Click Users → Create user.
3. Name it something like cdk-user and continue.
4. On Set permissions, choose Attach policies directly and select AdministratorAccess.
5. Review and click Create user.

Heads up: AdministratorAccess is generous for a single-user project like this one. CDK genuinely needs broad permissions to bootstrap and deploy — creating IAM roles, S3 buckets, and whatever else a stack asks for — so a narrowly-scoped policy would realistically block your very first cdk bootstrap. A real production setup scopes this down once you know exactly which services your stacks touch; for learning, it's the right tradeoff.

Generate access keys

1. Open the new user's Security credentials tab.
2. Under Access keys, click Create access key.
3. Choose Command Line Interface (CLI) as the use case.
4. Click Create access key, then download the .csv file. You won't be able to retrieve the secret key again after leaving this page.

Configure the CLI

aws configure

This asks for four things, all in the .csv you just downloaded (except the last two, which you choose yourself):

• AWS Access Key ID
• AWS Secret Access Key
• Default region name — the AWS region CDK deploys to when you don't specify one (us-east-1, eu-west-1, whatever's closest to you)
• Default output format — json is a reasonable default

From here on, every aws and cdk command you run uses this user's credentials, not root's.