Your AWS root credentials can fail in two opposite ways. If someone else gets them, the result is an unmitigated disaster. If you protect them so thoroughly that you cannot recover them, an emergency can turn into weeks of account recovery. Plenty of guidance covers root credentials in professional environments. This post is for personal AWS account owners who need a secure setup they can afford and maintain.
Keep Root Out of Daily Work #
Most days, your root credentials should stay untouched. Use IAM Identity Center for daily administration. For deployments and other automation, use temporary credentials or OIDC federation as described in Three Ways to Stop Using Long-Term AWS Credentials.
The root user remains available for rare account-level tasks and emergencies that no other identity can handle. AWS documents the small set of tasks that require root credentials. Do not create root access keys or use root for routine administration.
This matters even more in a standalone account or the management account of an AWS Organization. Service control policies do not restrict the management account. The controls in Personal AWS Guardrails for AI-Assisted Projects can protect workload accounts, but they cannot contain a compromised management-account root user.
Put Root MFA on a Hardware Key #
Store a unique root password in your password manager. For the second factor, register a FIDO security key such as a YubiKey and keep it away from your everyday devices.
A YubiKey has no battery that can expire while it sits unused, unlike a display-based TOTP token. It also keeps root MFA out of Google Authenticator, Apple Passwords, or whichever app handles your daily sign-ins. The key can stay somewhere safe until you actually need root.
AWS recommends registering multiple MFA devices and that remains good advice for a personal account. Many readers still have no hardware MFA, so start by ordering one YubiKey today and registering it for root. I have no affiliate link or commercial interest in that recommendation. If you are really up for it, register a second key and ask your favorite aunt to keep it for you.
The password and hardware key make root harder to steal. A physical key can still be lost or damaged, so the other failure mode needs its own plan.
Build a Recovery Path You Can Maintain #
Your account email recovers the root password. If all MFA devices are lost, recovery depends on your primary contact phone number (and that same email for verification).
For a personal account, these recovery details are part of the minimum setup:
- A dedicated, long-lived account email. Choose an address you expect to control for years, and maintain its own recovery details.
- A stable primary phone number. Use a number you expect to keep, and enter it in full international format. Avoid a burner or rarely used prepaid number that may expire.
Together with the unique password and hardware key, these form the four-part baseline. Losing one device should not remove every route back into the account.
A professional environment can create more separation. A security team might hold the recovery phone and backup YubiKey while an administrator controls the password and account mailbox. The key can be returned when custody changes. A password known by someone must be reset. At home, separate devices and storage locations provide a practical version of that protection.
Keep Your Recovery Details Current #
Email and phone details can look like account paperwork, but they decide whether self-service recovery works. Our lockout eight years ago started with a recovery phone number that belonged to a former colleague. The number had also been entered without its country code.
When we contacted our former colleague, they willingly tried to help. Their cooperation could not make the AWS recovery call reach a number that had never been recorded correctly.
AWS documents the normal routes clearly. You can reset the root password through the account email. You can recover from a lost MFA device by verifying the account email and primary contact phone. If neither route works, AWS directs you to Support for account recovery.
At the time of our incident, Support required notarized documents that linked our legal entity to the account. Recovery took weeks. That level of proof is understandable when AWS must distinguish the owner from someone attempting an account takeover.
For a personal account, the delay and notarial fees can be disproportionate to the account’s value. Keep the account email and phone under your control, and update them as soon as either changes.
Remove Standing Root Credentials From Member Accounts #
After recovering our account eight years ago, we ended up with a keychain full of YubiKeys for our different AWS accounts. Since November 2024, you no longer need this setup. AWS introduced centralized root access management, so member accounts can operate without standing root credentials while short-term privileged sessions keep emergency tasks practical. The management account still needs its own protected root credentials.
You enable and operate the feature from the management account or an IAM delegated administrator account. New member accounts then have no root credentials by default. You can remove the password, access keys, signing certificates, and MFA registrations from existing member accounts.
An authorized IAM identity in the management account or delegated administrator can still request a short-term privileged root session for a small set of rescue tasks:
- Delete an S3 bucket policy that denies everyone access to the bucket.
- Delete an SQS queue policy that denies everyone access to the queue.
- Audit or delete root credentials in a member account.
- Temporarily allow root password recovery for a member account.
Each session receives temporary credentials limited to the selected task. You keep an emergency route without recreating a permanent root login.
For a personal AWS Organization, this changes the scale of the problem. You can protect one standing root user in the management account instead of buying and storing a hardware key for every member account.
Protect Both Ways Root Can Fail #
A personal AWS account does not need enterprise ceremony. It does need the full minimum: a unique root password, one hardware security key, a dedicated account email, and a stable phone number. Keep those recovery details current, then keep root out of daily work.
Improve root MFA one step today. If its one-time code currently lives in the same password manager as the root password, add one hardware security key. If you already use a hardware key, consider a cost-effective backup that you can store separately without widening access.
References #
- Tasks that require root user credentials: operations that still require the account root user
- Root user best practices for your AWS account: AWS guidance for limiting and protecting root access
- Centralize root access for member accounts: remove member-account root credentials and enable privileged sessions
- Perform a privileged task on an AWS Organizations member account: supported short-term root sessions for S3, SQS, and root credential recovery
- Recover an MFA protected identity in IAM: use additional MFA devices or alternative root recovery factors
- Reset a lost or forgotten root user password: recover a root password through the account email
- Troubleshooting AWS account sign-in issues: recovery guidance for lost email, password, or MFA access
- SEC01-BP02: Secure account root user and properties: Well-Architected guidance for root-user protection
