AWS IAM with Terraform: Create Users Step-by-Step

AWS IAM with Terraform is one of the first practical automation tasks most cloud engineers encounter. Instead of manually creating users and permissions through the AWS Management Console, you can define IAM resources as code, track changes in Git, and deploy them consistently across environments.

In this tutorial, you'll learn how to create an AWS IAM user with Terraform, configure authentication securely, troubleshoot common issues, and follow best practices used in production environments.

Why Use AWS IAM with Terraform?

Identity and Access Management (IAM) controls who can access AWS resources and what actions they can perform. Managing IAM manually works for small environments, but it quickly becomes difficult to maintain as infrastructure grows.

Using Terraform for IAM management provides several advantages:

Consistent IAM configurations across environments
Version-controlled infrastructure changes
Easier auditing and compliance tracking
Faster onboarding for users and teams
Repeatable deployments across AWS accounts

If you're new to Terraform on AWS, start with our guide on Getting Started with Terraform on AWS.

Prerequisites for AWS IAM with Terraform

Before creating IAM resources, make sure you have:

An active AWS account
Terraform installed locally
AWS CLI installed
AWS credentials with permission to create IAM resources

If Terraform is not installed yet, follow our guide on Installing Terraform.

You should also understand how Terraform providers work. Read AWS provider in Terraform before continuing.

Create an AWS IAM User with Terraform

Terraform supports AWS IAM resources through the official AWS provider available in the Terraform Registry.

The following example creates an IAM user:

resource "aws_iam_user" "admin_user" {
  name = "lucy"

  tags = {
    description = "Technical Team Leader"
  }
}

In this configuration:

aws_iam_user is the resource type
admin_user is the Terraform resource name
name defines the IAM username
tags help organize and manage resources

This is the simplest Terraform IAM user example and serves as a foundation for managing users, groups, policies, and roles.

Configure the AWS Provider for Terraform

Terraform needs the AWS provider to communicate with your AWS account.

Create a provider configuration:

provider "aws" {
  region = "us-west-2"
}

Although IAM is a global AWS service, Terraform still requires a default region for provider initialization.

Avoid placing AWS credentials directly inside the provider block. Most engineering teams use AWS CLI profiles, IAM roles, or federated authentication instead.

For more details about providers, see Using Terraform Providers.

Common Errors During Terraform Initialization

After creating your configuration, initialize Terraform:

terraform init

Then preview the changes:

terraform plan

New users commonly encounter these errors.

Error: Missing AWS Region

Error: Missing required region

Terraform requires a region in the AWS provider configuration, even when working with global services such as IAM.

Error: No Valid Credential Sources Found

Error: No valid credential sources found

Possible causes include:

AWS CLI not configured
Missing environment variables
Expired session credentials
Insufficient IAM permissions
Incorrect AWS profile configuration

Secure Ways to Authenticate Terraform to AWS

Authentication is one of the most important aspects of managing AWS infrastructure.

Method 1: Configure AWS CLI Credentials

Install the AWS CLI and run:

aws configure

You'll be prompted to enter:

AWS Access Key ID
AWS Secret Access Key
Default Region
Output Format

Terraform automatically reads credentials stored in the AWS CLI configuration.

AWS CLI documentation: https://docs.aws.amazon.com/cli/

Method 2: Use Environment Variables

You can also authenticate using environment variables:

export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export AWS_DEFAULT_REGION="us-west-2"

This approach keeps credentials out of Terraform configuration files.

Production Tip

If AWS credentials are accidentally committed to GitHub or another repository, rotate them immediately.

AWS recommends using IAM roles and temporary credentials whenever possible instead of long-lived access keys. You can learn more from the official AWS IAM documentation:

https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html

Deploy the IAM User Using Terraform

After configuring authentication, generate an execution plan:

terraform plan

Review the proposed changes carefully.

When everything looks correct, create the IAM user:

terraform apply

Terraform will display the execution plan and ask for confirmation.

Type:

yes

Terraform then creates the IAM user in AWS.

Verify the IAM User Was Created

After deployment, verify the resource directly from AWS:

aws iam get-user --user-name lucy

A successful response confirms that the IAM user exists in your AWS account.

This verification step helps ensure that the resource was created correctly and not just recorded in Terraform state.

Best Practices for AWS IAM with Terraform

Managing IAM resources becomes easier when you follow a few proven practices.

Never Hardcode Credentials

Avoid storing:

Access keys
Secret keys
Session tokens

inside Terraform files.

Use AWS CLI profiles, environment variables, IAM roles, or AWS IAM Identity Center instead.

Use Terraform State Securely

Store state remotely when working in teams.

You can learn more about:

Separate Environments Properly

Use separate environments for:

Development
Testing
Staging
Production

Terraform workspaces can help manage multiple environments efficiently. Read our guide on Terraform Workspaces.

Use Modules for Reusability

Instead of duplicating IAM configurations, create reusable modules.

Learn more:

Prefer IAM Roles Over IAM Users

In modern AWS environments, IAM roles are often preferred over IAM users because they support temporary credentials and reduce credential management risks.

Managing IAM Policies with Terraform

Creating a user is only the first step.

Most real-world deployments also require:

IAM policies
IAM groups
IAM roles
Policy attachments

To continue building your IAM knowledge, read our detailed guide on IAM Policies with Terraform.

Conclusion

Creating AWS IAM resources with Terraform gives you a repeatable and auditable way to manage access control in AWS.

The same workflow used to create a single IAM user can scale to hundreds of users, groups, policies, and roles across multiple AWS accounts. As your infrastructure grows, managing IAM as code becomes significantly easier than maintaining permissions manually.

Frequently Asked Questions (FAQs)

What is AWS IAM used for?

AWS IAM (Identity and Access Management) controls authentication and authorization across AWS services. It determines who can access resources and what actions they can perform within an AWS account.

Can I create IAM roles using Terraform?

Yes. Terraform supports IAM roles, policies, groups, users, and policy attachments. Many production environments primarily use IAM roles because they provide temporary credentials and improve security.

Is it safe to hardcode AWS credentials in Terraform?

No. Hardcoding credentials creates security risks and increases the likelihood of accidental exposure. AWS recommends using IAM roles, AWS CLI profiles, environment variables, or federated authentication methods.

Why does Terraform require a region for IAM resources?

IAM is a global AWS service, but the AWS provider still requires a default region during initialization. The region allows Terraform to initialize provider configuration correctly.

How do I delete IAM resources managed by Terraform?

Remove the resource block from your Terraform configuration and run:

terraform apply

Terraform will detect that the resource no longer exists in the configuration and schedule it for deletion.

Can Terraform manage existing IAM users?

Yes. Existing IAM resources can be imported into Terraform state using the terraform import command. Learn more in our guide on Terraform Import.