Your agency has asked for access to AWS. You don't need to share your password for it. AWS lets you add them with their own login, choose exactly what they can do, and remove them when the project ends. These are the clicks, checked against AWS's own help pages in October 2026.
Which role to choose
Pick the narrowest role that lets your agency do the work. PowerUserAccess is usually the right one.
| Role | What it allows | For an agency |
|---|---|---|
| PowerUserAccess | Builds and runs anything in AWS, except managing IAM, AWS Organizations and account settings. | Usually the right one |
| ReadOnlyAccess | Sees every resource and setting, including stored data, without changing anything. | If the work needs it |
| AdministratorAccess | Full access to everything, including users and permissions. | If the work needs it |
Add your agency to AWS
- Sign in to the AWS console as an administrator and open IAM.
- Choose Roles, then Create role, then AWS account, then Another AWS account.
- Enter the account ID your agency gave you, tick Require external ID and paste the external ID from your agency.
- Choose Next, tick PowerUserAccess, choose Next again, name the role and choose Create role.
- Open the new role and send its ARN to your agency.
How you both know it worked
AWS emails your agency an invitation from signin.aws. Once they accept it, they show in your AWS account's list of people with access, where you can see or change their role at any time.
Remove access when the project ends
- Sign in to the AWS console, open IAM and choose Roles.
- Tick the role made for your agency, choose Delete, type the role name and choose Delete.
- If you added your agency's email address in IAM Identity Center instead, delete that user there.
Do you have to share your password?
No. Every step above uses AWS's own invite, so your agency signs in with their own account, your two-step verification stays on, and anything they change is recorded under their name. How to give a developer access without sharing your password covers the other accounts agencies usually ask for.
Doing this for every client?
Agencies can send each client one Get Set Keys link instead of a page like this. It walks the client through AWS and the other platforms the project needs, and checks that each step is done.