diff --git a/CHANGELOG.md b/CHANGELOG.md
index 905299d..ae3a4e7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -60,3 +60,7 @@
 
 * 2.8.0 -- 2022-08-01
   - add create-profile.USERNAME.sh generation
+
+* 2.8.1 -- 2022-08-12
+  - fix create_profile to edit census-do1 to do2-govcloud
+  - generate only if access_keys enabled
diff --git a/access_keys.tf b/access_keys.tf
index 77a44bd..f8fc474 100644
--- a/access_keys.tf
+++ b/access_keys.tf
@@ -94,3 +94,13 @@ resource "null_resource" "access_key_file_decrypt_key" {
     command = "${path.module}/bin/decrypt-secret-key.sh ${self.triggers.access_key_file}"
   }
 }
+resource "local_sensitive_file" "user_create_profile" {
+  count           = var.create_access_keys ? 1 : 0
+  filename        = format("%v/access_keys/%v/create-profile.sh", path.root, aws_iam_user.user.name)
+  file_permission = "0755"
+  content = templatefile("${path.module}/templates/create-profile.sh.tpl", {
+    username       = aws_iam_user.user.name
+    source_profile = local.profile
+    source_region  = local.region
+  })
+}
diff --git a/main.tf b/main.tf
index bd39fe0..a33b240 100644
--- a/main.tf
+++ b/main.tf
@@ -183,13 +183,3 @@ resource "aws_iam_user_policy" "user_policy" {
   user     = aws_iam_user.user.name
   policy   = each.value
 }
-
-resource "local_sensitive_file" "user_create_profile" {
-  filename        = format("%v/access_keys/%v/create-profile.sh", path.root, aws_iam_user.user.name)
-  file_permission = "0755"
-  content = templatefile("${path.module}/templates/create-profile.sh.tpl", {
-    username       = aws_iam_user.user.name
-    source_profile = local.profile
-    source_region  = local.region
-  })
-}
diff --git a/templates/create-assumerole-profile.sh.tpl b/templates/create-assumerole-profile.sh.tpl
index feeee76..2199e1f 100644
--- a/templates/create-assumerole-profile.sh.tpl
+++ b/templates/create-assumerole-profile.sh.tpl
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-VERSION="1.0.2"
+VERSION="1.0.3"
 SOURCE_PROFILE=$1
 if [ -z "$SOURCE_PROFILE" ]
 then
@@ -12,6 +12,9 @@ then
   USER="${username}"
 fi
 
+# fixup source profile census-do1 -> do2-govcloud
+SOURCE_PROFILE=$(echo $SOURCE_PROFILE | sed -e 's/census-do1$/do2-govcloud/')
+
 %{ for group,arn in groups ~}
 NEW_PROFILE="${profile_prefix}-${group}"
 if [ $(aws configure list-profiles | grep -c ^$NEW_PROFILE$) == 0 ]
diff --git a/templates/create-profile.sh.tpl b/templates/create-profile.sh.tpl
index 75d6c25..9b12f01 100644
--- a/templates/create-profile.sh.tpl
+++ b/templates/create-profile.sh.tpl
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-VERSION="1.0.1"
+VERSION="1.0.2"
 SOURCE_PROFILE=$1
 if [ -z "$SOURCE_PROFILE" ]
 then
@@ -23,6 +23,9 @@ then
   exit 1
 fi
 
+# fixup source profile census-do1 -> do2-govcloud
+SOURCE_PROFILE=$(echo $SOURCE_PROFILE | sed -e 's/census-do1$/do2-govcloud/')
+
 aws_access_key_id=$( grep ^access_key_id: $FILE | sed -e 's/^.*: *//')
 aws_secret_access_key=$( grep ^access_secret_key: $FILE | sed -e 's/^.*: *//')
 
diff --git a/version.tf b/version.tf
index b6c6af9..af62a23 100644
--- a/version.tf
+++ b/version.tf
@@ -1,4 +1,4 @@
 locals {
   _module_name    = "aws-iam-user"
-  _module_version = "2.8.0"
+  _module_version = "2.8.1"
 }