---
title: IAM user
description: Add an IAM user access key, with optional MFA.
---

An IAM user session holds a long-lived access key in the OS keychain. With `--mfa-device`, Start calls STS `GetSessionToken` with your code and the tools receive short-lived credentials. Without MFA, the tools receive the access key, shown with a 12 hour expiry.

```sh
rolle session add iam-user --name personal --region us-west-2 --access-key-id AKIA...
# rolle prompts for the secret access key when you omit --secret-access-key
rolle start personal --mfa-code 123456
```

| Flag | Meaning |
| --- | --- |
| `--name` | Session name |
| `--region` | Default region |
| `--access-key-id` | Access key ID |
| `--secret-access-key` | Secret access key. Prompted when omitted |
| `--mfa-device` | MFA device ARN or serial. The desktop app asks for the code on Start |
| `--profile` | AWS profile name. Empty uses `default` |
| `--from-profile` | Read the key of this profile in `~/.aws/credentials` instead of `--access-key-id` |

## From the credentials file

`--from-profile` reads the access key of a profile in `~/.aws/credentials`. The session and its profile take the profile's name. The region and `mfa_serial` come from the matching `~/.aws/config` section. Without a region, the session takes the default region from Settings. `--name`, `--region`, `--mfa-device`, and `--profile` override these values. The key stays in the file. `rolle cleanup <profile>` removes it, and rolle then serves the profile.

```sh
rolle session add iam-user --from-profile personal
rolle cleanup personal
```