---
title: IAM user
description: Add an IAM user access key, with optional MFA.
---

An IAM user session holds a long-lived access key in the OS keychain. With `--mfa-device` set, Start calls STS `GetSessionToken` with your code, and the tools receive short-lived credentials. Without MFA, the tools receive the access key itself, shown with a 12 hour expiry.

```sh
rolle session add iam-user --name personal --region us-west-2 --access-key-id AKIA...
# rolle prompts for the secret access key when you omit --secret-access-key
rolle start personal --mfa-code 123456
```

| Flag | Meaning |
| --- | --- |
| `--name` | Session name |
| `--region` | Default region |
| `--access-key-id` | Access key ID |
| `--secret-access-key` | Secret access key. Prompted when omitted |
| `--mfa-device` | MFA device ARN or serial. The desktop app asks for the code on Start |
| `--profile` | AWS profile name. Empty uses `default` |