{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"aws/account-and-iam","name":"AWS account, root MFA and IAM access","status":"researched","last_verified":null,"last_researched":"2026-10-25","disclaimer":"Plain-English summary of the provider’s rules and of what people report. Not legal advice.","terms":[{"kind":"rules_say","kind_label":"The rules say","severity":"red","severity_label":"Can get you banned","title":"Acceptable Use Policy","text":"AWS forbids illegal or fraudulent use, attacks on other systems, and unsolicited mass email or messages, and may remove or disable access to resources that break the policy. Plain-English summary, not legal advice.","source_url":"https://aws.amazon.com/aup/","source_title":"AWS Acceptable Use Policy","accessed":"2026-10-25"},{"kind":"rules_say","kind_label":"The rules say","severity":"amber","severity_label":"Can cost money","title":"Leaked keys get quarantined","text":"If an access key appears publicly, AWS attaches a deny policy (AWSCompromisedKeyQuarantineV3) to limit fraud and opens a support case; you still pay for anything an attacker ran. Never commit keys to a repo.","source_url":"https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCompromisedKeyQuarantineV3.html","source_title":"AWSCompromisedKeyQuarantineV3 - AWS Managed Policy","accessed":"2026-10-25"},{"kind":"people_report","kind_label":"People report","severity":"amber","severity_label":"Can cost money","title":null,"text":"In a security researcher's test, AWS quarantined a key about 10 seconds after it was pushed to a public GitHub repository.","source_url":"https://unit42.paloaltonetworks.com/detecting-exposed-aws-iam-credentials/","source_title":"Unit 42 - detecting exposed AWS IAM credentials","accessed":"2026-10-25"},{"kind":"rules_say","kind_label":"The rules say","severity":"amber","severity_label":"Can cost money","title":"Free plan accounts close after 6 months","text":"On the Free plan the account closes 6 months after opening or when credits run out, whichever comes first, unless you upgrade to the Paid plan. On the Paid plan usage beyond credits is billed pay-as-you-go.","source_url":"https://aws.amazon.com/free/","source_title":"AWS Free Tier","accessed":"2026-10-25"},{"kind":"rules_say","kind_label":"The rules say","severity":"yellow","severity_label":"Worth knowing","title":"Root MFA is mandatory","text":"All AWS account types must have MFA on the root user; register it within 35 days of the first console sign-in attempt.","source_url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html","source_title":"Multi-factor authentication for AWS account root user - IAM User Guide","accessed":"2026-10-25"}],"renewals":[{"what":"Upgrade from the Free plan to the Paid plan (or the account closes)","every":"6 months after account creation (one-off)","source_url":"https://aws.amazon.com/free/"},{"what":"Rotate any long-term IAM user access keys","every":"when needed (e.g. when someone leaves); AWS gives no fixed period","source_url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"}],"pricing_notes":{"free_tier":"New accounts get $100 in credits plus up to $100 more for exploring services (up to $200), usable for up to 6 months on the Free plan; over 30 Always Free services within monthly limits.","costs":"Pay-as-you-go per service on the Paid plan once credits are used.","notes":null,"source_url":"https://aws.amazon.com/free/"},"guide_url":"https://verapli.com/guides/aws/account-and-iam"}