4 ms·
Good points. > as a root account you should have 2FA enabled. But if you want a yubikey, you can only add one, with no fallback for a TOTP device - lose your y
by Hackbraten 4y ago
Good points.
> as a root account you should have 2FA enabled. But if you want a yubikey, you can only add one, with no fallback for a TOTP device - lose your yubikey and you're at the mercy of AWS support.
As a fallback for my spare Yubikeys, I have created a couple of dummy, web-only IAM users with root privileges.
Still an embarrassing UX failure on AWS’s side though.
- mschuster91 4y agoThe worst thing IMO is that the AWS API and the UI seems to be already designed with multiple 2FA devices in mind. I have absolutely zero idea what took them over the last years from implementing this absolutely basic feature.
- nucleardog 4y agoFor what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges. Last I checked (and by that I mean found out the hard way) there are still places across AWS that you can lock everyone but root out of. Particularly it seems around a few of the places where you're configuring policies on specific resources rather than through IAM. We ended up setting a policy on an S3 bucket that locked everyone out. The root account _always_ has permissions to edit/remove that policy, but the policy itself prevented the admin accounts from removing it.
- Hackbraten 4y ago> For what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges. You’re correct, those have the AdministratorAccess policy, not root. It’s been a while since I set those up. For practical purposes, wouldn’t AdministratorAccess be sufficient to recover from a lost (root user’s) YubiKey?