diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7998991..905299d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -57,3 +57,6 @@
 
 * 2.7.4 -- 2022-06-27
   - fix pgp key detection
+
+* 2.8.0 -- 2022-08-01
+  - add create-profile.USERNAME.sh generation
diff --git a/README.md b/README.md
index 43d49e7..73af96c 100644
--- a/README.md
+++ b/README.md
@@ -103,6 +103,7 @@ No requirements.
 | [aws_ses_email_identity.user_send_mail](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ses_email_identity) | resource |
 | [local_file.rotate_keys_tfvars](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
 | [local_sensitive_file.access_key_file](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/sensitive_file) | resource |
+| [local_sensitive_file.user_create_profile](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/sensitive_file) | resource |
 | [null_resource.access_key_file_decrypt_key](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
 | [null_resource.rotate_keys_tfvars](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
 | [time_sleep.wait_iam_access_key_v1](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
diff --git a/main.tf b/main.tf
index a33b240..9521fa6 100644
--- a/main.tf
+++ b/main.tf
@@ -183,3 +183,13 @@ resource "aws_iam_user_policy" "user_policy" {
   user     = aws_iam_user.user.name
   policy   = each.value
 }
+
+resource "local_sensitive_file" "user_create_profile" {
+  filename        = format("%v/access_keys/%v/create-profile.%v.sh", path.root, aws_iam_user.user.name)
+  file_permission = "0755"
+  content = templatefile("${path.root}/templates/create-profile.sh.tpl", {
+    username       = aws_iam_user.user.name
+    source_profile = var.profile
+    source_region  = local.region
+  })
+}
diff --git a/templates/create-assumerole-profile.sh.tpl b/templates/create-assumerole-profile.sh.tpl
new file mode 100644
index 0000000..feeee76
--- /dev/null
+++ b/templates/create-assumerole-profile.sh.tpl
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+VERSION="1.0.2"
+SOURCE_PROFILE=$1
+if [ -z "$SOURCE_PROFILE" ]
+then
+  SOURCE_PROFILE="${source_profile}"
+fi
+
+if [ -z $USER ]
+then
+  USER="${username}"
+fi
+
+%{ for group,arn in groups ~}
+NEW_PROFILE="${profile_prefix}-${group}"
+if [ $(aws configure list-profiles | grep -c ^$NEW_PROFILE$) == 0 ]
+then
+  echo "echo \"# v$VERSION: creating assume-role profile $NEW_PROFILE\""
+  echo "aws configure set profile.$NEW_PROFILE.source_profile $SOURCE_PROFILE"
+  echo "aws configure set profile.$NEW_PROFILE.region ${source_region}"
+  echo "aws configure set profile.$NEW_PROFILE.role_arn ${arn}"
+  echo "aws configure set profile.$NEW_PROFILE.role_session_name $USER"
+else
+  echo "echo \"# profile $NEW_PROFILE already created with source_profile $SOURCE_PROFILE\""
+fi
+echo "echo \"# TEST: aws --profile $NEW_PROFILE sts get-caller-identity\""
+echo "echo \"\""
+
+%{ endfor ~}
diff --git a/templates/create-profile.sh.tpl b/templates/create-profile.sh.tpl
new file mode 100644
index 0000000..75d6c25
--- /dev/null
+++ b/templates/create-profile.sh.tpl
@@ -0,0 +1,50 @@
+#!/bin/bash
+
+VERSION="1.0.1"
+SOURCE_PROFILE=$1
+if [ -z "$SOURCE_PROFILE" ]
+then
+  SOURCE_PROFILE="${source_profile}"
+fi
+
+if [ -z $USER ]
+then
+  USER="${username}"
+fi
+
+if [ -z $FILE ]
+then
+  FILE="access_key.yml"
+fi
+
+if [ ! -r $FILE ]
+then
+  echo "# unable to find $FILE, exiting"
+  exit 1
+fi
+
+aws_access_key_id=$( grep ^access_key_id: $FILE | sed -e 's/^.*: *//')
+aws_secret_access_key=$( grep ^access_secret_key: $FILE | sed -e 's/^.*: *//')
+
+if [ -z $aws_access_key_id ]
+then
+  echo "# access_key_id missing from $FILE"
+  exit 1
+fi
+if [ -z $aws_secret_access_key ]
+then
+  echo "# acess_secret_key missing from $FILE"
+  exit 1
+fi
+
+if [ $(aws configure list-profiles | grep -c ^$SOURCE_PROFILE$) == 0 ]
+then
+  echo "echo \"# v$VERSION: creating source profile $SOURCE_PROFILE\""
+  echo "aws configure set profile.$SOURCE_PROFILE.aws_access_key_id $aws_access_key_id"
+  echo "aws configure set profile.$SOURCE_PROFILE.aws_secret_access_key $aws_secret_access_key"
+  echo "aws configure set profile.$SOURCE_PROFILE.region ${source_region}"
+  echo "aws configure set profile.$SOURCE_PROFILE.output json"
+else
+  echo "echo \"# profile $SOURCE_PROFILE already created\""
+fi
+echo "echo \"# TEST: aws --profile $SOURCE_PROFILE sts get-caller-identity\""
diff --git a/version.tf b/version.tf
index 6850d18..b6c6af9 100644
--- a/version.tf
+++ b/version.tf
@@ -1,4 +1,4 @@
 locals {
   _module_name    = "aws-iam-user"
-  _module_version = "2.7.4"
+  _module_version = "2.8.0"
 }