1

Within our corporation, we have a dedicated team that manages our AWS footprint. For each dev/app team, we provision a new account with a VPC and some networking to attach it to our pan-galactic network mesh. However the root keys for that account owner are kept and managed by our AWS management team. The devs are allocated IAM accounts with superadmin privs so they can pretty much do whatever they want but we still maintain master control.

The problem is that with a team of people, you can't easily create the root account and attach MFA to it. Amazon has some suggestions that basically boil down to setting a complex lengthy password on the account then just lose the password.

Are there solutions that enable a group of individuals in a team to manage a common MFA so we can enable MFA on the root account?

Improve this question
2
  • Not sure if this will help but you can have multiple accounts for different teams, they can be billed under single account.
    – user119076
    Commented Sep 6, 2017 at 11:55
  • "Root keys"? Are you talking about the user / password / MFA combination, or an SSH key? IAM users are best for console access. Under Linux you'll want separate users each with their own ssh key.
    – Tim
    Commented Oct 1, 2017 at 19:30

1 Answer 1

Reset to default
1

In a properly secured AWS account, the root account should only be used as a "break glass in case of emergencies" thing. Users should be using IAM accounts as their "daily driver". I would enable MFA on the root account, and print or save a copy of the QR code. Put it in a safe or vault. Only pull it out when you need it.

You can scan the MFA QR code multiple times, so you can have several devices setup for MFA.

Improve this answer
3
  • an example of a need to use the root account is adding a new team member to a project, or removing one for someone who has left the project.
    – Skaperen
    Commented Sep 6, 2017 at 1:20
  • 1
    @Skaperen - I have the standard AWS AdministratorAccess role, and have no problem adding or removing users. What problem were you seeing?
    – kdgregory
    Commented Sep 6, 2017 at 14:17
  • @Skaperen IAM user accounts can manage other IAM users, as long as they have the proper permissions.
    – myron-semack
    Commented Sep 6, 2017 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .