4 ms·

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com cred

by YPPH 5y ago

Some of these are legitimate grievances but it seems quite reasonable to have separate accounts for work and play. What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part. I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner.

Galanwe 5y ago
> What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. This bite me hard last year... I lost my phone and with it my MFA for the root account, and of course forgot to properly backup the MFA seed. Now when calling AWS support to get back my accesses, they ask me to prove ownership of my Amazon.com account with the same email... Which is like 15 years old. I changed phone number, address, country dozens of times since then. Apparently I would have to get back to my home country and ask a notary to sign a paper asserting I am really me to get back my accesses. Nightmare.
- danielheath 5y ago
  As you have learned, setting up 2fa for an important service isn’t something to be done lightly. My current setup is two yubikeys (one in storage, one in my computer) and OTP on my phone. Failure is still possible but it’s unlikely enough for me.
  - smt88 5y ago
    I'd love to do this, but many services still only support SMS or don't support multiple hardware keys.
imwillofficial 5y ago
These are two different sets of Creds, or should be.
- YPPH 5y ago
  Hm, well they're the same for me and I get redirected to Amazon.com to edit certain pieces of AWS account information. Perhaps it's because my account is very old - possibly having been created near the inception of AWS. I have no memory of creating the account.
  - waf 5y ago
    Right, AWS accounts created before September 2017 are coupled to amazon.com retail accounts. Accounts created after this are separate.
    - mcherm 5y ago
      For those of us with coupled accounts, is there any way to separate them?
      - LilBytes 5y ago
        Change the root user email on your AWS account or the Amazon retail address to something different.
        psanford 5y ago
        That doesn't work for old accounts. Changing your root email address will also change it for the retail account. This is documented behavior by AWS: https://aws.amazon.com/premiumsupport/knowledge-center/transfer-aws-account/ https://aws.amazon.com/premiumsupport/knowledge-center/trans...
        LilBytes 5y ago
        Thanks for the correction. I thought my personal account was this old already, clearly not.
hhsub 5y ago
That's kinda your fault for not having created two accounts, innit
- deleted 5y ago
  [deleted]
koolba 5y ago
> I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner. Clearly the solution to this is for the retail site to support IAM roles.
- mxz3000 5y ago
  That made me chuckle
- quickthrower2 5y ago
  Yeah make it so confusing nobody buys anything!
andrewnicolalde 5y ago
Is this the case for you? Mine are totally different. How did they get tied together?
- YPPH 5y ago
  Yes, it is. If I try to change my AWS root account password, I get redirected to Amazon.com. My account is very old. From the sounds of it, my grievance has been addressed by Amazon but I'm grandfathered on the old system.
- jffry 5y ago
  Up until 3-4 years ago, if you created an AWS account with the same email address as your amazon.com shopping account, Amazon would automatically link the two together, without warning and without a setting to undo this. Changing the password on one changed the other too. This connection persisted for accounts made after AWS stopped doing this, probably for backwards compatibility reasons. At least when I dealt with this mess a couple years ago, AWS support did not have reassuring answers. They claimed they could separate it, but if something went wrong we were on our own without spending large amounts of money on premium support. Lucky for me most of our resources were already in child AWS accounts and the rest could be migrated, so I was able to create a _new_ top-level AWS account, re-parent the child accounts, and delete the old parent account instead. At least with that process we could create a throwaway child account and test every step before doing it for real with production.
solatic 5y ago
You can change an AWS account's root account's email address. Even if you don't want to set up a new email account just for your AWS root account, many email providers include additional forwarding addresses as a feature, or use something like the Gmail feature where `me+aws-root-account@gmail.com` gets sent to me@gmail.com`; from AWS's perspective these are completely different email addresses even if Gmail treats them as the same Gmail account.
- LilBytes 5y ago
  I'm using the same method. But only went down this like the grandfather comment where I'd already been bitten by having the same email as amazon@domain.com for both AWS and Amazon. Fortunately creating aliases in Fastmail is very trivial.
- psanford 5y ago
  Nope. For accounts created before 2017, if you change the root account's email address it changes the Amazon.com retail account's email address as well. This is documented behavior by AWS[0]: > If your AWS account and Amazon.com retail account share the same login information, updating the email address or password on one of the accounts changes information on the other account. [0]: https://aws.amazon.com/premiumsupport/knowledge-center/transfer-aws-account/ https://aws.amazon.com/premiumsupport/knowledge-center/trans...
mabbo 5y ago
Without going into too much detail, this "coupled account" problem is taken very seriously internally (AWS Identity dev, my opinions are my own and I don't speak for the company). There is a very large project to fix this. But as you can probably imagine, with a system this large and complex making changes to fundamentals like identities is hard, and done with a lot of care. All new accounts created today are "decoupled". They are not your Amazon account, and (barring some special internal tools for testing) you cannot make them the same account. But migrating all the existing accounts without causing harm is a messy business. My own AWS account has the same problem.
- cj 5y ago
  > detail, this "coupled account" problem is taken very seriously internally I can say for certain that no, it is not something taken seriously. I (loudly) complained to AWS enterprise support in 2017, 4 years ago, about this issue. Got escalated as high as could possibly be escalated (team leads of IAM calling my cell phone). 4 years later and the issue is unresolved. This is Amazon we’re talking about. There’s very little that can’t be fixed in 4 years.
- mcharezinski 5y ago
  Could you please share some of the technical challenges about the migration?
  - mabbo 5y ago
    I'm not a spokesperson for the company and really don't feel comfortable saying anything specific about this. Generically: Identity is a very hard space. It's one of those things that sounds really simple but the deeper you go the more edge cases you find. With an complex systems, changing fundamental designs of the system- while users and other systems are currently using that system- is like trying to upgrade the engines on a plane while in flight. Technically possible, with a lot of planning, but any wrong move or bad assumption and you're going to crash.
- FridayoLeary 5y ago
  Is there work on Amazon.com itself? Because basically everything there needs fixing. But the filters would be a very good place to begin a sorely needed facelift.
fairramone 5y ago
I have enabled 2FA on my Amazon account and also on my root AWS account. In order to log in to AWS using my root account, I must enter two 2FA responses: one for my Amazon account, the other for my AWS root account. It's weird!

by YPPH 5y ago

Galanwe 5y ago

> What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. This bite me hard last year... I lost my phone and with it my MFA for the root account, and of course forgot to properly backup the MFA seed. Now when calling AWS support to get back my accesses, they ask me to prove ownership of my Amazon.com account with the same email... Which is like 15 years old. I changed phone number, address, country dozens of times since then. Apparently I would have to get back to my home country and ask a notary to sign a paper asserting I am really me to get back my accesses. Nightmare.

danielheath 5y ago
As you have learned, setting up 2fa for an important service isn’t something to be done lightly. My current setup is two yubikeys (one in storage, one in my computer) and OTP on my phone. Failure is still possible but it’s unlikely enough for me.
- smt88 5y ago
  I'd love to do this, but many services still only support SMS or don't support multiple hardware keys.

imwillofficial 5y ago

These are two different sets of Creds, or should be.

YPPH 5y ago
Hm, well they're the same for me and I get redirected to Amazon.com to edit certain pieces of AWS account information. Perhaps it's because my account is very old - possibly having been created near the inception of AWS. I have no memory of creating the account.
- waf 5y ago
  Right, AWS accounts created before September 2017 are coupled to amazon.com retail accounts. Accounts created after this are separate.
  - mcherm 5y ago
    For those of us with coupled accounts, is there any way to separate them?
    - LilBytes 5y ago
      Change the root user email on your AWS account or the Amazon retail address to something different.
      - psanford 5y ago
        That doesn't work for old accounts. Changing your root email address will also change it for the retail account. This is documented behavior by AWS: https://aws.amazon.com/premiumsupport/knowledge-center/transfer-aws-account/ https://aws.amazon.com/premiumsupport/knowledge-center/trans...
        LilBytes 5y ago
        Thanks for the correction. I thought my personal account was this old already, clearly not.

hhsub 5y ago

That's kinda your fault for not having created two accounts, innit

deleted 5y ago
[deleted]

koolba 5y ago

> I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner. Clearly the solution to this is for the retail site to support IAM roles.

mxz3000 5y ago
That made me chuckle
quickthrower2 5y ago
Yeah make it so confusing nobody buys anything!

andrewnicolalde 5y ago

Is this the case for you? Mine are totally different. How did they get tied together?

YPPH 5y ago
Yes, it is. If I try to change my AWS root account password, I get redirected to Amazon.com. My account is very old. From the sounds of it, my grievance has been addressed by Amazon but I'm grandfathered on the old system.
jffry 5y ago
Up until 3-4 years ago, if you created an AWS account with the same email address as your amazon.com shopping account, Amazon would automatically link the two together, without warning and without a setting to undo this. Changing the password on one changed the other too. This connection persisted for accounts made after AWS stopped doing this, probably for backwards compatibility reasons. At least when I dealt with this mess a couple years ago, AWS support did not have reassuring answers. They claimed they could separate it, but if something went wrong we were on our own without spending large amounts of money on premium support. Lucky for me most of our resources were already in child AWS accounts and the rest could be migrated, so I was able to create a _new_ top-level AWS account, re-parent the child accounts, and delete the old parent account instead. At least with that process we could create a throwaway child account and test every step before doing it for real with production.

solatic 5y ago

You can change an AWS account's root account's email address. Even if you don't want to set up a new email account just for your AWS root account, many email providers include additional forwarding addresses as a feature, or use something like the Gmail feature where `me+aws-root-account@gmail.com` gets sent to me@gmail.com`; from AWS's perspective these are completely different email addresses even if Gmail treats them as the same Gmail account.

LilBytes 5y ago
I'm using the same method. But only went down this like the grandfather comment where I'd already been bitten by having the same email as amazon@domain.com for both AWS and Amazon. Fortunately creating aliases in Fastmail is very trivial.
psanford 5y ago
Nope. For accounts created before 2017, if you change the root account's email address it changes the Amazon.com retail account's email address as well. This is documented behavior by AWS[0]: > If your AWS account and Amazon.com retail account share the same login information, updating the email address or password on one of the accounts changes information on the other account. [0]: https://aws.amazon.com/premiumsupport/knowledge-center/transfer-aws-account/ https://aws.amazon.com/premiumsupport/knowledge-center/trans...

mabbo 5y ago

Without going into too much detail, this "coupled account" problem is taken very seriously internally (AWS Identity dev, my opinions are my own and I don't speak for the company). There is a very large project to fix this. But as you can probably imagine, with a system this large and complex making changes to fundamentals like identities is hard, and done with a lot of care. All new accounts created today are "decoupled". They are not your Amazon account, and (barring some special internal tools for testing) you cannot make them the same account. But migrating all the existing accounts without causing harm is a messy business. My own AWS account has the same problem.

cj 5y ago
> detail, this "coupled account" problem is taken very seriously internally I can say for certain that no, it is not something taken seriously. I (loudly) complained to AWS enterprise support in 2017, 4 years ago, about this issue. Got escalated as high as could possibly be escalated (team leads of IAM calling my cell phone). 4 years later and the issue is unresolved. This is Amazon we’re talking about. There’s very little that can’t be fixed in 4 years.
mcharezinski 5y ago
Could you please share some of the technical challenges about the migration?
- mabbo 5y ago
  I'm not a spokesperson for the company and really don't feel comfortable saying anything specific about this. Generically: Identity is a very hard space. It's one of those things that sounds really simple but the deeper you go the more edge cases you find. With an complex systems, changing fundamental designs of the system- while users and other systems are currently using that system- is like trying to upgrade the engines on a plane while in flight. Technically possible, with a lot of planning, but any wrong move or bad assumption and you're going to crash.
FridayoLeary 5y ago
Is there work on Amazon.com itself? Because basically everything there needs fixing. But the filters would be a very good place to begin a sorely needed facelift.

fairramone 5y ago

I have enabled 2FA on my Amazon account and also on my root AWS account. In order to log in to AWS using my root account, I must enter two 2FA responses: one for my Amazon account, the other for my AWS root account. It's weird!