How to Create an AWS Account and Securely Invite Outside Collaborators

When bringing on an external agency, consultant, or technical partner to help manage your cloud infrastructure, you shouldn't just hand over your master password. Instead, the safest approach is to create a clean AWS account, configure dedicated permissions, and invite your team members using modern identity management tools.

This gives you complete control and ownership over everything, while letting us do the work.

In this quick guide, we'll walk you through setting up an AWS account from scratch and creating a secure invitation so our team can get to work without compromising your root security.

Step 1: Create a New AWS Account

1. Head over to aws.amazon.com and click Create an AWS Account.
2. Enter a Root User Email Address and an account name.

   Tip: If this is for business, use a corporate email distribution list (like aws-admin@yourcompany.com) rather than an individual employee's personal email.

3. Verify your email address using the confirmation code sent to your inbox, and create a strong master password.
4. Fill out your contact information and enter a valid credit card for billing. (AWS will place a temporary $1 authorization hold to verify the card).
5. Complete the identity verification via SMS or phone call, choose the Basic (Free) Support Plan, and click Complete Sign Up.
6. Once you are on a dashboard screen, go to the top right and click on your account name. Then click on security credentials. (This requires a paid account)

note: the rest of the steps require a paid account, but it just requires the $1 temporary hold, you do not need to start paying for things yet.

Step 2: Enable IAM Identity Center

To grant us access securely, AWS uses IAM Identity Center (formerly AWS SSO). This creates a separate portal for us to log into without touching your root credentials.

1. Log into your new AWS account using your root email and password.
2. In the top search bar, search for IAM Identity Center and click on it.
3. Click the orange Enable button. If prompted to choose a region, choose the geographic region closest to your business operations.

Step 3: Create a Permission Set

Think of a permission set as a security boundary defining exactly what our team is allowed to touch.

1. Inside the IAM Identity Center dashboard, look at the left sidebar and click AWS Accounts.
2. Select the Permission sets tab, then click Create permission set.
3. Choose Predefined permission set and click Next.
4. Select the policy level requested by your partner (typically AdministratorAccess for full configuration, or PowerUserAccess if you wish to restrict billing control).
5. Click through to review and hit Create.

Step 4: Invite Us to the Account

Now, you'll generate the user identity for our team.

1. In the IAM Identity Center left sidebar, click Users, then click Add user.
2. Fill out the details for your technical partner:
   • Username: (e.g., partner-company-admin)
   • Email Address: [Insert Partner's Designated Email Here]
   • First/Last Name: Partner / Admin
3. Under Password, ensure Send an email to this user with password setup instructions is selected. Click Next.
4. Skip the "Groups" page by clicking Next, review the details, and click Add user.

Step 5: Map the Permissions to the User

The user exists, but they don't have access to your specific AWS account yet. Let's connect them.

1. Go back to AWS Accounts in the left sidebar.
2. Check the box next to your AWS Account name in the list, and click Assign users or groups.
3. Select the Users tab, check the box next to the user you just created, and click Next.
4. Check the box next to the Permission Set you created in Step 3 (e.g., AdministratorAccess), and click Next.
5. Click Submit.

All done! Your technical partner will automatically receive an invitation email directly from Amazon Web Services containing their unique login portal link. They will accept it, configure their own Multi-Factor Authentication (MFA), and get to work securely.