<commit_before>---
owner_slack: "#govuk-2ndline"
title: Use AWS on the command line
section: AWS accounts
layout: manual_layout
parent: "/manual.html"
last_reviewed_on: 2018-10-10
review_in: 3 months
---

💡 Before you can access something in AWS, you [need to set up your AWS
account][set-up-account].

---

## 1. Create `~/.aws/config`

1. You can find the `role_arn` in the ["Role ARN" table][secret-docs]
1. You can find your `mfa_serial` under "Assigned MFA device" in your user
   profile [in the AWS Console][aws-console]:

  ![](images/aws-how-to-get-mfa.png)

Create `~/.aws/config`:

```ini
[profile govuk-<environment>]
source_profile = gds
role_arn = <Role ARN>
mfa_serial = <MFA ARN>

[profile gds]
region = eu-west-1
```

## 2. Create `~/.aws/credentials`

First, create a pair of [access keys][access-keys].

![](images/aws-how-to-get-access-keys.png)

Create `~/.aws/credentials`:

```ini
[gds]
aws_access_key_id = <access key id>
aws_secret_access_key = <secret access key>
```

## 3. Test it! 🚀

To test your configuration run:

```
aws --profile govuk-integration s3 ls
```

You should be prompted for an MFA token. If successful, you should receive some
output.

[set-up-account]: /manual/set-up-aws-account.html
[aws-console]: /manual/aws-console-access.html
[secret-docs]: https://github.com/alphagov/govuk-aws-data/blob/master/docs/govuk-aws-accounts.md
[access-keys]: https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys<commit_msg>Add link to IAM service<commit_after>---
owner_slack: "#govuk-2ndline"
title: Use AWS on the command line
section: AWS accounts
layout: manual_layout
parent: "/manual.html"
last_reviewed_on: 2018-10-10
review_in: 3 months
---

💡 Before you can access something in AWS, you [need to set up your AWS
account][set-up-account].

---

## 1. Create `~/.aws/config`

1. You can find the `role_arn` in the ["Role ARN" table][secret-docs]
1. You can find your `mfa_serial` under "Assigned MFA device" in your user
   profile [in the AWS Console][aws-console], under the [IAM
   service][iam-service]:

  ![](images/aws-how-to-get-mfa.png)

Create `~/.aws/config`:

```ini
[profile govuk-<environment>]
source_profile = gds
role_arn = <Role ARN>
mfa_serial = <MFA ARN>

[profile gds]
region = eu-west-1
```

## 2. Create `~/.aws/credentials`

First, create a pair of [access keys][access-keys].

![](images/aws-how-to-get-access-keys.png)

Create `~/.aws/credentials`:

```ini
[gds]
aws_access_key_id = <access key id>
aws_secret_access_key = <secret access key>
```

## 3. Test it! 🚀

To test your configuration run:

```
aws --profile govuk-integration s3 ls
```

You should be prompted for an MFA token. If successful, you should receive some
output.

[set-up-account]: /manual/set-up-aws-account.html
[aws-console]: /manual/aws-console-access.html
[iam-service]: https://console.aws.amazon.com/iam/home?#/users
[secret-docs]: https://github.com/alphagov/govuk-aws-data/blob/master/docs/govuk-aws-accounts.md
[access-keys]: https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys
{'fraction_non_alphanumeric': 0.15952685421994886, 'fraction_numerical': 0.010869565217391304, 'mean_word_length': 4.146381578947368, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 5, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6702591', 'n_tokens_mistral': 1192, 'n_tokens_neox': 1128, 'n_words': 305}