title: Creating AWS IAM user access key specifically for SES
body: <p>I'm tracking how to <a href="https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-using-sdk-python.html" rel="nofollow noreferrer">send an Email Using the AWS SDK for Python (Boto)</a>.</p>
  
  <p>At the AWS Developer Guide <a href="https://docs.aws.amazon.com/ses/latest/DeveloperGuide/using-credentials.html" rel="nofollow noreferrer">using-credentials</a> page I read that:</p>
  
  <blockquote>
    <p>For security best practice, use <em>AWS Identity and Access Management (IAM) user access keys</em> instead of <em>AWS account access keys</em> [emphasis added].</p>
  </blockquote>
  
  <p>Then at the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html" rel="nofollow noreferrer">Managing Access Keys for IAM Users</a> I am eventually led to this <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey_CLIAPI" rel="nofollow noreferrer">section</a> and I duly confirm using </p>
  
  <pre><code>aws iam list-access-keys
  </code></pre>
  
  <p>that I have just created (in JSON form):</p>
  
  <pre><code>{
      "AccessKeyMetadata": [
          {
              "UserName": "My_User_Name", 
              "Status": "Active", 
              "CreateDate": "2018-09-03T00:43:37Z", 
              "AccessKeyId": "JRUFKDHUWHE8DD495CHD"
          }
      ]
  }
  </code></pre>
  
  <p>but I lack clarity about whether this identity is the "AWS account access keys" that I was earlier warned does not fall in the "security best practice".</p>
  
  <p>How do I create an IAM identity (user access + password) for sending email through SES and boto (while eliminating the chance I am exposing the entire AWS account)?</p>
  
  <p>Ranting (and a constructive suggestion to AWS staff writers, if here): Specific branding would help. At Ikea I might order a chair or a table with the meaningless name Fjorstuvstok, but I know with certainty that I am ordering the chair I want.</p>