How to Enable AWS Console Access for an Existing IAM User

Problem

An existing AWS IAM user has programmatic access through access keys but cannot sign in to the AWS Management Console.

To sign in to the console, an IAM user needs a login profile with a password. You can set this up without having to recreate the user or change their current permissions.

Solution

1. Check whether console access is enabled

aws iam get-login-profile --user-name my-user

If you see NoSuchEntity in the output, it means the user does not have a login profile, as long as the IAM user exists.

2. Enable console access

Create a login profile with a temporary password:

aws iam create-login-profile \
  --user-name my-user \
  --password 'TemporaryPassword123!' \
  --password-reset-required

The --password-reset-required option makes the user change their password the next time they sign in.

The password here is just an example. In real situations, do not pass actual passwords directly in the command line.

3. Reset an existing console password

If the user already has a login profile, use update-login-profile instead:

aws iam update-login-profile \
  --user-name my-user \
  --password 'NewTemporaryPassword123!' \
  --password-reset-required

4. Get the AWS Console login URL

Generate the sign-in URL using your current AWS account ID:

echo "https://$(aws sts get-caller-identity \
  --query Account --output text).signin.aws.amazon.com/console"

The URL you get will look like this: https://123456789012.signin.aws.amazon.com/console. Be sure your AWS CLI credentials are for the account where the IAM user exists.

Things to Watch Out For

  • IAM permissions: The admin needs iam:CreateLoginProfile to enable console access, iam:GetLoginProfile to check for it, and iam:UpdateLoginProfile to reset a password.
  • Existing permissions: Creating a login profile does not give the user any new AWS permissions. Their current IAM policies still control what they can do.
  • Password security: Do not pass real passwords as CLI arguments, since they could show up in shell history or process lists. AWS suggests using --cli-input-json for passwords. Always protect and securely delete any files with credentials. Password policy: The temporary password must meet your AWS account’s IAM password rules. Make sure the user can change their password when they first sign in.
  • MFA: Turn on multi-factor authentication for users who sign in to the console.
  • IAM Identity Center: These commands apply only to IAM users, not IAM Identity Center (SSO) identities.

References