I asked AWS:
- How do I recover access to AWS Account in case I lost device with Google Authenticator installed?
- In case my email was hacked, what will prevent hacker from removing MFA?
Their answer essentially was:
When you fill up the form, there is specialized team (Not from Premium Support) will contact you via phone ONLY within 15 minutes to verify your identity and ownership of this account. They have a very strict procedures to be followed before removing MFA from the root account. Any incorrect answer for their questions will result rejecting this request and ending the phone call.
Since I need to know how verification process works in order to protect information required, I asked for more details. After some back and forth their final answer was:
We know customers care deeply about privacy and data security, and that’s why our customers retain control of what security they choose to implement to protect their own content, platform, applications, systems and networks, no differently than they would for applications in an on-site datacenter. Disclosing our processes violate our privacy and security policies.We encourage you to refer to resources on the AWS Site for best practices in securing your account, as provided earlier, including the AWS Security Blog: https://aws.amazon.com/blogs/security/
Thank you for your understanding.
Why don't they make verification process transparent, otherwise isn't it some kind of security through obscurity?
What can I do to make sure I don't get locked out of my AWS root account?
How to make sure that hacker who broke first layer of authentication is not able to reset MFA?