{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"30582431a0401deb7992a62301da7e3970335fffb58db891ffe6e7afc25930c0","entry":{"id":"aws/account-and-iam","name":"AWS account, root MFA and IAM access","vendor":"Amazon Web Services","summary":"Create an AWS account (root user, payment method, phone check, support plan), secure the root user with MFA, then give day-to-day access through IAM Identity Center or, only where a tool needs long-term keys, an IAM user access key.","aliases":["aws","amazon-web-services","aws-account","aws-iam"],"category":"hosting","group":"B","homepage":"https://aws.amazon.com/","docs":["https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html","https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html","https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"acct-create","url":"https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html","title":"Create an AWS account - AWS Account Management","accessed":"2026-10-25","supports":"Sign-up flow (payment method, phone verification, support plan, Complete sign up); activation \"usually takes a few minutes but can sometimes take up to 24 hours\"; confirmation email; Complete Sign Up button may still show while activating.","kind":"official"},{"id":"repost-activate","url":"https://repost.aws/knowledge-center/create-and-activate-aws-account","title":"AWS re:Post Knowledge Center - create and activate an AWS account","accessed":"2026-10-25","supports":"Order of sign-up (payment, phone identity check, support plan); India-based accounts may need additional verification. Seen via search summary; direct fetch returned 403.","kind":"official"},{"id":"root-mfa","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html","title":"Multi-factor authentication for AWS account root user - IAM User Guide","accessed":"2026-10-25","supports":"All account types require root user MFA; register MFA within 35 days of first console sign-in attempt if not enabled; passkeys/security keys recommended.","kind":"official"},{"id":"root-mfa-news","url":"https://aws.amazon.com/about-aws/whats-new/2025/06/aws-iam-mfa-root-users-across-all-account-types","title":"AWS IAM now enforces MFA for root users across all account types (What's New, June 2025)","accessed":"2026-10-25","supports":"Root MFA enforcement timeline (standalone accounts from June 2024, all account types announced June 2025).","kind":"official"},{"id":"iam-bp","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html","title":"Security best practices in IAM","accessed":"2026-10-25","supports":"Humans should use federation / IAM Identity Center with temporary credentials; workloads should use roles; long-term access keys only where needed (third-party clients, workloads that cannot use roles) and rotated; least privilege; protect root credentials.","kind":"official"},{"id":"free-tier","url":"https://aws.amazon.com/free/","title":"AWS Free Tier","accessed":"2026-10-25","supports":"New accounts get $100 credits plus up to $100 more (up to $200); Free plan lasts up to 6 months and the account closes after 6 months or when credits run out unless upgraded to a Paid plan; Free plan limited to select services; Paid plan pay-as-you-go.","kind":"official"},{"id":"aup","url":"https://aws.amazon.com/aup/","title":"AWS Acceptable Use Policy","accessed":"2026-10-25","supports":"Prohibits illegal/fraudulent use, security violations, unsolicited mass email or messages; AWS may investigate and remove or disable access to violating content or resources.","kind":"official"},{"id":"quarantine-policy","url":"https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCompromisedKeyQuarantineV3.html","title":"AWSCompromisedKeyQuarantineV3 - AWS Managed Policy","accessed":"2026-10-25","supports":"AWS attaches a deny policy to an IAM user whose credentials are exposed publicly to limit fraud; do not remove it, follow the support case instructions.","kind":"official"},{"id":"unit42-quarantine","url":"https://unit42.paloaltonetworks.com/detecting-exposed-aws-iam-credentials/","title":"Unit 42 - detecting exposed AWS IAM credentials","accessed":"2026-10-25","supports":"Test where a key pushed to a public GitHub repo was quarantined by AWS about 10 seconds later.","kind":"community"}],"allowed_domains":["aws.amazon.com"],"account_model":{"summary":"One AWS account is the billing and security boundary. It has a root user (the sign-up email) that should only be used for a few account tasks. People get access through IAM Identity Center users (temporary credentials) or IAM users; workloads get IAM roles. Larger set-ups group accounts under AWS Organizations.","accounts":[{"name":"AWS account (root user)","kind":"billing","owned_by":"the person or the company that signs up","required":true,"note":"The root email and password, plus root MFA, control everything including closing the account."},{"name":"IAM Identity Center user (administrator)","kind":"developer","parent":"AWS account (root user)","required":false,"note":"Recommended way for people to sign in day to day; gives short-lived credentials to the CLI via SSO."},{"name":"IAM user with access key","kind":"developer","parent":"AWS account (root user)","required":false,"note":"Only for tools that cannot use Identity Center or roles; keys are long-term and must be rotated."}],"notes":["Personal or business account type is chosen at sign-up; choose business for a company so invoices carry the company name.","Free plan versus Paid plan is chosen at sign-up; a Free plan account closes after 6 months unless upgraded."]},"have_ready":[{"kind":"domain_email","description":"An email address for the root user that the company controls long term (ideally a shared alias, not a personal inbox).","why":"The root email recovers the whole account; losing access to it is very hard to fix.","needed_for":["sign-up"],"auto_check":"domain_email_mx"},{"kind":"payment_card","description":"A valid credit or debit card (or other payment method AWS offers in your country).","why":"Sign-up cannot continue without a valid payment method.","needed_for":["payment"],"auto_check":"none","source":"acct-create"},{"kind":"phone_for_2fa","description":"A phone that can receive an SMS or voice call for the identity check.","needed_for":["phone-check"],"auto_check":"none","source":"acct-create"},{"kind":"other","description":"An MFA device for the root user - a passkey or hardware security key is recommended, an authenticator app also works.","needed_for":["root-mfa"],"auto_check":"none","source":"root-mfa"},{"kind":"proof_of_address","description":"Billing/contact address exactly as on company or personal records.","needed_for":["sign-up"],"auto_check":"none"}],"steps":[{"id":"sign-up","title":"Start AWS sign-up (root email, account name, contact details)","summary":"You enter the root email, verify it, set the root password and fill in contact details, choosing Personal or Business. verapli can fill non-secret fields from your profile; you create the account yourself.","route":"copilot","depends_on":[],"gate":"human_submit","url":"https://portal.aws.amazon.com/billing/signup","fields":[{"label":"Root user email address","from_profile":"domain_email"},{"label":"Full name / company name","from_profile":"legal_name"},{"label":"Phone number","from_profile":"phone"},{"label":"Address","from_profile":"registered_address"}],"preflight":["domain_has_mx"]},{"id":"payment","title":"Add a payment method","summary":"You enter card details on AWS's own page. verapli never touches payment details.","route":"guided","depends_on":["sign-up"],"gate":"human_payment","recovery":[{"hiccup":"Card is declined or the payment step will not continue.","fix":"Check the billing address matches the card issuer's record, make sure the card allows online/international payments and small verification charges, or try another card."}],"sources":["acct-create"]},{"id":"phone-check","title":"Confirm your identity by phone","summary":"AWS sends a code by SMS or voice call; you type it in yourself.","route":"guided","depends_on":["payment"],"gate":"2fa","recovery":[{"hiccup":"The code never arrives or the call fails.","fix":"Retry with the other contact method (voice instead of SMS) and check the country code; if it keeps failing, contact AWS Support from the sign-up page."}],"sources":["acct-create","repost-activate"]},{"id":"support-plan","title":"Choose a support plan and complete sign-up","summary":"Pick the free Basic support plan unless you need paid support, then press Complete sign up yourself.","route":"guided","depends_on":["phone-check"],"gate":"human_terms","lead_time":{"official":{"text":"Activation usually takes a few minutes but can sometimes take up to 24 hours; a confirmation email is sent.","source":"acct-create"}},"recovery":[{"hiccup":"Still not activated after 24 hours, or the console keeps showing Complete Sign Up.","fix":"The button can show during activation. If it has been over 24 hours, sign in again and check every sign-up step was finished (closing the window early leaves it incomplete), then contact AWS Support.","source":"acct-create"},{"hiccup":"Account based in India asks for extra verification.","fix":"Complete the additional verification AWS asks for (India-based accounts may need it).","source":"repost-activate"}]},{"id":"root-mfa","title":"Turn on MFA for the root user","summary":"Sign in as root and register a passkey, security key or authenticator app. AWS requires root MFA on all account types and gives 35 days from the first console sign-in attempt.","route":"guided","depends_on":["support-plan"],"gate":"human_login","url":"https://console.aws.amazon.com/iam/","preflight":["mfa_enabled"],"sources":["root-mfa","root-mfa-news"]},{"id":"identity-center-admin","title":"Create a day-to-day admin user in IAM Identity Center","summary":"Enable IAM Identity Center, create a user for yourself and give it administrator access to this account, then stop using root. The CLI signs in with `aws configure sso` and gets short-lived credentials, so no long-term key is stored.","route":"guided","depends_on":["root-mfa"],"gate":"human_submit","url":"https://console.aws.amazon.com/singlesignon/","sources":["iam-bp"]},{"id":"access-key","title":"Create an IAM user access key (only if a tool needs long-term keys)","summary":"For a third-party tool that cannot use Identity Center or roles, create an IAM user with only the permissions it needs and create an access key. The secret is shown once; verapli captures it by selector into your env file.","route":"copilot","depends_on":["identity-center-admin"],"gate":"human_submit","url":"https://console.aws.amazon.com/iam/","recovery":[{"hiccup":"AWS emails that a key was exposed and the user suddenly gets AccessDenied on many actions.","fix":"AWS attached the AWSCompromisedKeyQuarantine policy. Do not just remove it; follow the AWS support case: deactivate and delete the exposed key, check for resources an attacker created, then create a new key.","source":"quarantine-policy"}],"capture":{"env":"AWS_SECRET_ACCESS_KEY","kind":"secret"},"optional":true,"sources":["iam-bp"]}],"outputs":[{"name":"AWS_ACCESS_KEY_ID","description":"Access key id of the IAM user (only when the access-key step is used).","secret":true,"example_format":"AKIA…","from_step":"access-key"},{"name":"AWS_SECRET_ACCESS_KEY","description":"Secret access key of the IAM user; shown once at creation.","secret":true,"example_format":"40-character secret","from_step":"access-key"},{"name":"AWS_REGION","description":"Default AWS Region for SDKs and the CLI, e.g. eu-west-2.","secret":false,"example_format":"eu-west-2"},{"name":"AWS_ACCOUNT_ID","description":"12-digit AWS account id.","secret":false,"example_format":"12 digits"}],"terms_notes":[{"kind":"rules_say","severity":"red","title":"Acceptable Use Policy","text":"AWS forbids illegal or fraudulent use, attacks on other systems, and unsolicited mass email or messages, and may remove or disable access to resources that break the policy. Plain-English summary, not legal advice.","source":"aup"},{"kind":"rules_say","severity":"amber","title":"Leaked keys get quarantined","text":"If an access key appears publicly, AWS attaches a deny policy (AWSCompromisedKeyQuarantineV3) to limit fraud and opens a support case; you still pay for anything an attacker ran. Never commit keys to a repo.","source":"quarantine-policy"},{"kind":"people_report","severity":"amber","text":"In a security researcher's test, AWS quarantined a key about 10 seconds after it was pushed to a public GitHub repository.","source":"unit42-quarantine"},{"kind":"rules_say","severity":"amber","title":"Free plan accounts close after 6 months","text":"On the Free plan the account closes 6 months after opening or when credits run out, whichever comes first, unless you upgrade to the Paid plan. On the Paid plan usage beyond credits is billed pay-as-you-go.","source":"free-tier"},{"kind":"rules_say","severity":"yellow","title":"Root MFA is mandatory","text":"All AWS account types must have MFA on the root user; register it within 35 days of the first console sign-in attempt.","source":"root-mfa"}],"renewals":[{"what":"Upgrade from the Free plan to the Paid plan (or the account closes)","every":"6 months after account creation (one-off)","source":"free-tier"},{"what":"Rotate any long-term IAM user access keys","every":"when needed (e.g. when someone leaves); AWS gives no fixed period","source":"iam-bp"}],"pricing_notes":{"free_tier":"New accounts get $100 in credits plus up to $100 more for exploring services (up to $200), usable for up to 6 months on the Free plan; over 30 Always Free services within monthly limits.","costs":"Pay-as-you-go per service on the Paid plan once credits are used.","source":"free-tier"},"stripe_projects":false,"api_provisioning":{"available":"partial","notes":"Creating the AWS account itself is a human sign-up. Once the account exists, IAM users, roles, Identity Center users and access keys can all be created through the IAM / Identity Center APIs and CLI.","docs":["https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"],"source":"iam-bp"},"detect":{"env_names":["AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_REGION","AWS_PROFILE"],"packages":["@aws-sdk/client-sts","boto3","aws-sdk"]}}}