{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"aws/account-and-iam","name":"AWS account, root MFA and IAM access","vendor":"Amazon Web Services","status":"researched","last_verified":null,"last_researched":"2026-10-25","summary":"Create an AWS account (root user, payment method, phone check, support plan), secure the root user with MFA, then give day-to-day access through IAM Identity Center or, only where a tool needs long-term keys, an IAM user access key.","account_model":{"summary":"One AWS account is the billing and security boundary. It has a root user (the sign-up email) that should only be used for a few account tasks. People get access through IAM Identity Center users (temporary credentials) or IAM users; workloads get IAM roles. Larger set-ups group accounts under AWS Organizations.","accounts":[{"name":"AWS account (root user)","kind":"billing","owned_by":"the person or the company that signs up","required":true,"note":"The root email and password, plus root MFA, control everything including closing the account."},{"name":"IAM Identity Center user (administrator)","kind":"developer","parent":"AWS account (root user)","required":false,"note":"Recommended way for people to sign in day to day; gives short-lived credentials to the CLI via SSO."},{"name":"IAM user with access key","kind":"developer","parent":"AWS account (root user)","required":false,"note":"Only for tools that cannot use Identity Center or roles; keys are long-term and must be rotated."}],"notes":["Personal or business account type is chosen at sign-up; choose business for a company so invoices carry the company name.","Free plan versus Paid plan is chosen at sign-up; a Free plan account closes after 6 months unless upgraded."]},"prerequisites":[],"identity_requires":[],"have_ready":[{"kind":"domain_email","description":"An email address for the root user that the company controls long term (ideally a shared alias, not a personal inbox).","why":"The root email recovers the whole account; losing access to it is very hard to fix.","needed_for":["sign-up"],"auto_check":"domain_email_mx","source_url":null},{"kind":"payment_card","description":"A valid credit or debit card (or other payment method AWS offers in your country).","why":"Sign-up cannot continue without a valid payment method.","needed_for":["payment"],"auto_check":"none","source_url":"https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html"},{"kind":"phone_for_2fa","description":"A phone that can receive an SMS or voice call for the identity check.","why":null,"needed_for":["phone-check"],"auto_check":"none","source_url":"https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html"},{"kind":"other","description":"An MFA device for the root user - a passkey or hardware security key is recommended, an authenticator app also works.","why":null,"needed_for":["root-mfa"],"auto_check":"none","source_url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html"},{"kind":"proof_of_address","description":"Billing/contact address exactly as on company or personal records.","why":null,"needed_for":["sign-up"],"auto_check":"none","source_url":null}],"steps":[{"id":"sign-up","title":"Start AWS sign-up (root email, account name, contact details)","summary":"You enter the root email, verify it, set the root password and fill in contact details, choosing Personal or Business. verapli can fill non-secret fields from your profile; you create the account yourself.","route":"copilot","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":[],"optional":false,"url":"https://portal.aws.amazon.com/billing/signup","lead_time":null,"preflight":["domain_has_mx"],"captures":null},{"id":"payment","title":"Add a payment method","summary":"You enter card details on AWS's own page. verapli never touches payment details.","route":"guided","gate":"human_payment","human_only":true,"gate_label":"You add payment details","depends_on":["sign-up"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"phone-check","title":"Confirm your identity by phone","summary":"AWS sends a code by SMS or voice call; you type it in yourself.","route":"guided","gate":"2fa","human_only":true,"gate_label":"You enter a 2-step code","depends_on":["payment"],"optional":false,"url":null,"lead_time":null,"preflight":[],"captures":null},{"id":"support-plan","title":"Choose a support plan and complete sign-up","summary":"Pick the free Basic support plan unless you need paid support, then press Complete sign up yourself.","route":"guided","gate":"human_terms","human_only":true,"gate_label":"You accept the terms","depends_on":["phone-check"],"optional":false,"url":null,"lead_time":{"official":{"text":"Activation usually takes a few minutes but can sometimes take up to 24 hours; a confirmation email is sent.","source_url":"https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html","source_title":"Create an AWS account - AWS Account Management"},"reported":null,"typical_minutes":null},"preflight":[],"captures":null},{"id":"root-mfa","title":"Turn on MFA for the root user","summary":"Sign in as root and register a passkey, security key or authenticator app. AWS requires root MFA on all account types and gives 35 days from the first console sign-in attempt.","route":"guided","gate":"human_login","human_only":true,"gate_label":"You sign in","depends_on":["support-plan"],"optional":false,"url":"https://console.aws.amazon.com/iam/","lead_time":null,"preflight":["mfa_enabled"],"captures":null},{"id":"identity-center-admin","title":"Create a day-to-day admin user in IAM Identity Center","summary":"Enable IAM Identity Center, create a user for yourself and give it administrator access to this account, then stop using root. The CLI signs in with `aws configure sso` and gets short-lived credentials, so no long-term key is stored.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["root-mfa"],"optional":false,"url":"https://console.aws.amazon.com/singlesignon/","lead_time":null,"preflight":[],"captures":null},{"id":"access-key","title":"Create an IAM user access key (only if a tool needs long-term keys)","summary":"For a third-party tool that cannot use Identity Center or roles, create an IAM user with only the permissions it needs and create an access key. The secret is shown once; verapli captures it by selector into your env file.","route":"copilot","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["identity-center-admin"],"optional":true,"url":"https://console.aws.amazon.com/iam/","lead_time":null,"preflight":[],"captures":"AWS_SECRET_ACCESS_KEY"}],"gates":[{"step":"sign-up","gate":"human_submit","label":"You press submit"},{"step":"payment","gate":"human_payment","label":"You add payment details"},{"step":"phone-check","gate":"2fa","label":"You enter a 2-step code"},{"step":"support-plan","gate":"human_terms","label":"You accept the terms"},{"step":"root-mfa","gate":"human_login","label":"You sign in"},{"step":"identity-center-admin","gate":"human_submit","label":"You press submit"},{"step":"access-key","gate":"human_submit","label":"You press submit"}],"lead_times":[{"step":"support-plan","what":"Choose a support plan and complete sign-up","official":{"text":"Activation usually takes a few minutes but can sometimes take up to 24 hours; a confirmation email is sent.","source_url":"https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html","source_title":"Create an AWS account - AWS Account Management"},"reported":null}],"outputs":[{"name":"AWS_ACCESS_KEY_ID","description":"Access key id of the IAM user (only when the access-key step is used).","secret":true,"example_format":"AKIA…","environments":null},{"name":"AWS_SECRET_ACCESS_KEY","description":"Secret access key of the IAM user; shown once at creation.","secret":true,"example_format":"40-character secret","environments":null},{"name":"AWS_REGION","description":"Default AWS Region for SDKs and the CLI, e.g. eu-west-2.","secret":false,"example_format":"eu-west-2","environments":null},{"name":"AWS_ACCOUNT_ID","description":"12-digit AWS account id.","secret":false,"example_format":"12 digits","environments":null}],"renewals":[{"what":"Upgrade from the Free plan to the Paid plan (or the account closes)","every":"6 months after account creation (one-off)","every_days":null,"source_url":"https://aws.amazon.com/free/"},{"what":"Rotate any long-term IAM user access keys","every":"when needed (e.g. when someone leaves); AWS gives no fixed period","every_days":null,"source_url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"}],"estimated_minutes":null,"guide_url":"https://verapli.com/guides/aws/account-and-iam"}