A user is one person or one program. A new user starts empty: no permissions, no password, no keys.

aws iam create-user --user-name dana

Access keys

The CLI signs every request with an access key: a key id, which is public, and a secret, which is not.

aws iam create-access-key --user-name dana

{
    "AccessKey": {
        "UserName": "dana",
        "AccessKeyId": "AKIAO57RW5VRSFQOA76Z",
        "Status": "Active",
        "SecretAccessKey": "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"
    }
}

The secret is shown once, in this answer, and never again. AWS keeps only what it needs to check signatures. If the secret is lost, you make a new key and delete the old one. A key id that starts with AKIA is a long-term key that belongs to a user.

Listing keys

aws iam list-access-keys --user-name dana

This shows each key's id, status and creation date, never its secret. A user may hold two keys, so a new key can be put in place before the old one is deleted.