Configure AWS for Terraform

Why the AWS CLI?

Terraform talks to AWS using credentials on your machine. The AWS CLI is the easiest way to configure and verify those credentials.

With the AWS CLI you can:

• Manage EC2, S3, IAM, and more from the terminal
• Store access keys in standard config files
• Confirm which account and user Terraform will use

Install the AWS CLI

Verify first

aws --version

Example:

aws-cli/2.27.50 Python/3.13.4 Darwin/24.5.0 source/arm64

If it is missing, install it.

Windows

Download and run the MSI installer from the AWS CLI install guide, then reopen your terminal and run aws --version.

macOS

brew install awscli
aws --version

Ubuntu / Linux

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version

Create an IAM user for Terraform

1. Sign in to the AWS Management Console.
2. Open IAM → Users → Create user.
3. User name: terraform-user.
4. Attach policies directly and select AdministratorAccess for learning labs.
5. Create the user.

Create access keys

1. Open terraform-user → Security credentials.
2. Under Access keys, choose Create access key.
3. Select Command Line Interface (CLI), confirm, and create the key.
4. Save the Access Key ID and Secret Access Key immediately — the secret is shown only once.

Configure AWS CLI

aws configure

Enter:

AWS Access Key ID: <your-access-key>
AWS Secret Access Key: <your-secret-key>
Default region name: ap-southeast-1
Default output format: json

Where credentials are stored

~/.aws/credentials:

[default]
aws_access_key_id = AKIAxxxxxxxxxxxx
aws_secret_access_key = xxxxxxxxxxxxxxxxxxxxxxxx

~/.aws/config:

[default]
region = ap-southeast-1
output = json

Verify the connection

aws sts get-caller-identity

Example response:

{
  "UserId": "AIDAXXXXXXXX",
  "Account": "123456789012",
  "Arn": "arn:aws:iam::123456789012:user/terraform-user"
}

Other useful checks:

aws configure list
aws s3 ls
aws iam list-users
aws ec2 describe-instances

Confirm Terraform can use AWS

Terraform uses the same default credential chain as the AWS CLI. After aws configure succeeds, a provider block like this is enough:

provider "aws" {
  region = "ap-southeast-1"
}

No access keys belong in your .tf files.