9 ms·
For AWS root account? Generate a long random password, print it out and then lock it in a safe without allowing anyone to see it. Turn on 2FA and then lock th
by NovemberWhiskey 6y ago
For AWS root account?
Generate a long random password, print it out and then lock it in a safe without allowing anyone to see it.
Turn on 2FA and then lock the second factor in a different safe.
There’s virtually never a need for the root account and it’s impossible to attenuate (by design).
- dmlittle 6y agoThis is a lot harder to do if you have lots of AWS accounts and create new ones over time on-demand (e.g. AWS account per team).
- NovemberWhiskey 6y agoUse Organizations. If you’re creating new standalone independent accounts for teams you’re just seeking yourself up for some kind of billing/security/governance catastrophe down the road.
- dmlittle 6y agoI was referring to the root accounts in your organization. The blast radius is more limited, but still a root account that has access to everything within that AWS account.
- time0ut 6y agoYou can restrict what the root account can do in a member account using SCPs as an additional safeguard as well.
- ericopf 6y agoPrinting out the AWS root password and putting in a safe is almost useless. Root password can be easily reset without MFA by having access to the email associated to the root AWS account. MFA is the important one to keep it safe for AWS root accounts, set for the master AWS account and lock root access for all member accounts via SCPs.