The terminal signs every command as admin, with the key in the [default] section of ~/.aws/credentials. To act as another user, give that user's key a section of its own: a profile.

Making a profile

Two commands write the key id and the secret into a section named dana:

aws configure set aws_access_key_id AKIAO57RW5VRSFQOA76Z --profile dana

aws configure set aws_secret_access_key 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 --profile dana

Use the id and secret from the answer to create-access-key. The credentials file now has two sections:

[default]
aws_access_key_id = AKIA…  (admin)
aws_secret_access_key = …

[dana]
aws_access_key_id = AKIAO57RW5VRSFQOA76Z
aws_secret_access_key = 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

Using it

--profile works on every command and lasts for that one command, like --region:

aws sts get-caller-identity --profile dana

The answer ends in user/dana: AWS accepted the key and knows who is asking.

aws s3 ls --profile dana

fatal error: An error occurred (AccessDenied) when calling the ListBuckets operation: User: arn:aws:iam::123456789012:user/dana is not authorized to perform: s3:ListAllMyBuckets because no identity-based policy allows the s3:ListAllMyBuckets action

The key worked, so this is not about who dana is. It is about what dana may do, and dana has no policies yet. The next lessons give dana some.