3 ms·

Sorry for your lost. For others, how do I prevent this? Any tips? Thanks.

• isbvhodnvemrwvn 5y ago
  - use a hardware MFA device like Yubikey (note: you can only register one hardware device, because AWS fucked up their implementation) - if you can't use hardware MFA for whatever reason, use TOTP (this allows backing up your MFA) - don't use the root account for anything other than creating less privileged users (ideally create an admin user that can do that, and never use your root account anymore, and only use the admin account to set up users) - the other users should use the principle of least privilege (only access to actions X, Y to resources Z, Ż, Ź) - if you can at all get rid of using access keys (e.g. via using roles), then do so - if you can't, never share them with anybody (don't commit it to git repos, that's for sure) The two first points are crucial, and I've never heard of an account fully compromised without sharing access keys that had MFA set up. For more details: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practi...