// file included in the following:
//
// con-aws-kms-setup.adoc

[id='con-aws-kms-setup-application-identity-long-term-{context}']

= Authenticating using long-term IAM identity

A long-term IAM identity with sufficient permissions must be created for the filter.

Use AWS IAM to create this identity and generate an *Access Key* for it.
The Access Key/Secret Key pair is used by the filter.
Do not enable console access for this user.

Using the CLI, the following commands create the IAM identity for the filter.
This example uses the user name `kroxylicious`, but you can choose a different name if needed.
Adjust the instructions accordingly if using a different user name.

[source,shell]
----
aws iam create-user --user-name kroxylicious
aws iam create-access-key --user-name kroxylicious
----

== Apply the alias-based policy to the filter's application identity

Attach the alias policy to the filter's application identity.
This will allow the filter to perform key operations on all KEKs with aliases that match the specified naming convention.

[source,shell]
----
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
aws iam attach-user-policy --user-name kroxylicious --policy-arn "arn:aws:iam::${AWS_ACCOUNT_ID}:policy/KroxyliciousRecordEncryption"
----
