To start, sign in to the AWS console. Then click on your name in the top right corner of the page.

When the menu opens click "Security credentials" inside of the drop down.

On the Security Credentials page, find and click on "Users" in the left side navigation under the "Access management" heading.

Next click on the "Create User" button near the top right corner of the page, in the main pane.

When prompted, enter a username to use for the access user. I chose "circuitpython_polly_user1", but you can use any name you like. Ideally choose something that you'll recognize later when it's listed in the console.

DO NOT check the box labeled "Provide user access to the AWS Management Console - optional". This option would give the new access user the ability to manage other services, billing and other details of the AWS account. It should only have access to fetch sound files from AWS Polly.

After you enter a username, click the "Next" button in the bottom right corner.

Now to set the permissions on this new access user account. 

Choose "Attach policies directly" from the choices in the "Permission options" box.

Next scroll down to the "Permission policies" box and enter the term "Polly" in the search box.

Click the checkbox next to "AmazonPollyReadOnly". The name may be truncated with ellipses.

Once the "AmazonPollyReadOnly" permission is checked, click the "Next" button in the bottom right corner.

The last step to create the user account is to confirm the details entered.

Verify that you are happy with the username.

Ensure that "AmazonPollyReadOnlyAccess" is the only thing listed in the "Permission summary" section. This account does not need any other permissions beyond that.

When everything looks good, click the "Create user" button in the bottom right.

After this is complete, you'll be taken back to a page listing all of the user accounts under your AWS console. You should see the new user account that you just created.

Now to get the API keys for this new restricted user account. 

Click on the username in the list of users on the Users page under Access management in the Security credentials page.

Once you are on the user detail page for the new user, click on the "Security credentials" navigation tab in the main pane.

Inside the Security credentials tab, scroll down and find the "Access keys" box. Click the "Create access key" button inside of it.

Select the "Other" use case from the list of available options.

Scroll down and click the "Next" button in the bottom right corner.

Next, you may optionally set a descriptive tag to use with this access key. I chose "circuitpython polly access", you can use anything you like or leave it blank.

Click the "Create access key" button once you are satisfied with the tag choice.

Finally, it's time to get the access keys needed!

After the access keys are created, you'll be taken to the Retrieve access keys page, where you can view/copy your Access key and Secret access key. 

The Spell Jam project will need both of these values. Use the copy buttons to copy them and paste them into your settings.toml file under the names AWS_ACCESS_KEY and AWS_SECRET_KEY. See example below.