verapli
Sign inJoin free
Menu

Guides · hosting · Verification-gated

AWS account, root MFA and IAM access

Create an AWS account (root user, payment method, phone check, support plan), secure the root user with MFA, then give day-to-day access through IAM Identity Center or, only where a tool needs long-term keys, an IAM user access key.

Researched · not yet run liveLast researched 25 October 2026 · Amazon Web Services · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

One AWS account is the billing and security boundary. It has a root user (the sign-up email) that should only be used for a few account tasks. People get access through IAM Identity Center users (temporary credentials) or IAM users; workloads get IAM roles. Larger set-ups group accounts under AWS Organizations.

  • AWS account (root user) billing owned by the person or the company that signs upThe root email and password, plus root MFA, control everything including closing the account.
  • IAM Identity Center user (administrator) developeroptional · under AWS account (root user)Recommended way for people to sign in day to day; gives short-lived credentials to the CLI via SSO.
  • IAM user with access key developeroptional · under AWS account (root user)Only for tools that cannot use Identity Center or roles; keys are long-term and must be rotated.

Personal or business account type is chosen at sign-up; choose business for a company so invoices carry the company name.

Free plan versus Paid plan is chosen at sign-up; a Free plan account closes after 6 months unless upgraded.

Have ready

  • An email address for the root user that the company controls long term (ideally a shared alias, not a personal inbox). · The root email recovers the whole account; losing access to it is very hard to fix. Needed for: Start AWS sign-up (root email, account name, contact details)
  • A valid credit or debit card (or other payment method AWS offers in your country). · Sign-up cannot continue without a valid payment method. [1]Needed for: Add a payment method
  • A phone that can receive an SMS or voice call for the identity check. [1]Needed for: Confirm your identity by phone
  • An MFA device for the root user - a passkey or hardware security key is recommended, an authenticator app also works. [3]Needed for: Turn on MFA for the root user
  • Billing/contact address exactly as on company or personal records. Needed for: Start AWS sign-up (root email, account name, contact details)

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Start AWS sign-up (root email, account name, contact details)

    You enter the root email, verify it, set the root password and fill in contact details, choosing Personal or Business. verapli can fill non-secret fields from your profile; you create the account yourself.

    • verapli co-pilot
    • Human step: You press submit

    Where: https://portal.aws.amazon.com/billing/signup

  2. Add a payment method

    You enter card details on AWS's own page. verapli never touches payment details.

    • Guided by hand
    • Human step: You add payment details
    • After: Start AWS sign-up (root email, account name, contact details)
    If something goes wrong (1)
    • Card is declined or the payment step will not continue.: Check the billing address matches the card issuer's record, make sure the card allows online/international payments and small verification charges, or try another card.

  3. Confirm your identity by phone

    AWS sends a code by SMS or voice call; you type it in yourself.

    • Guided by hand
    • Human step: You enter a 2-step code
    • After: Add a payment method
    If something goes wrong (1)
    • The code never arrives or the call fails.: Retry with the other contact method (voice instead of SMS) and check the country code; if it keeps failing, contact AWS Support from the sign-up page.

  4. Choose a support plan and complete sign-up

    Pick the free Basic support plan unless you need paid support, then press Complete sign up yourself.

    • Guided by hand
    • Human step: You accept the terms
    • After: Confirm your identity by phone
    The provider says
    Activation usually takes a few minutes but can sometimes take up to 24 hours; a confirmation email is sent. [1]
    If something goes wrong (2)
    • Still not activated after 24 hours, or the console keeps showing Complete Sign Up.: The button can show during activation. If it has been over 24 hours, sign in again and check every sign-up step was finished (closing the window early leaves it incomplete), then contact AWS Support. [1]
    • Account based in India asks for extra verification.: Complete the additional verification AWS asks for (India-based accounts may need it). [2]

  5. Turn on MFA for the root user

    Sign in as root and register a passkey, security key or authenticator app. AWS requires root MFA on all account types and gives 35 days from the first console sign-in attempt.

    • Guided by hand
    • Human step: You sign in
    • After: Choose a support plan and complete sign-up

    Where: https://console.aws.amazon.com/iam/

  6. Create a day-to-day admin user in IAM Identity Center

    Enable IAM Identity Center, create a user for yourself and give it administrator access to this account, then stop using root. The CLI signs in with `aws configure sso` and gets short-lived credentials, so no long-term key is stored.

    • Guided by hand
    • Human step: You press submit
    • After: Turn on MFA for the root user

    Where: https://console.aws.amazon.com/singlesignon/

  7. Create an IAM user access key (only if a tool needs long-term keys)optional

    For a third-party tool that cannot use Identity Center or roles, create an IAM user with only the permissions it needs and create an access key. The secret is shown once; verapli captures it by selector into your env file.

    • verapli co-pilot
    • Human step: You press submit
    • After: Create a day-to-day admin user in IAM Identity Center

    verapli captures AWS_SECRET_ACCESS_KEY here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • AWS emails that a key was exposed and the user suddenly gets AccessDenied on many actions.: AWS attached the AWSCompromisedKeyQuarantine policy. Do not just remove it; follow the AWS support case: deactivate and delete the exposed key, check for resources an attacker created, then create a new key. [8]

    Where: https://console.aws.amazon.com/iam/

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can get you bannedThe rules say

Acceptable Use Policy

AWS forbids illegal or fraudulent use, attacks on other systems, and unsolicited mass email or messages, and may remove or disable access to resources that break the policy. Plain-English summary, not legal advice. [7]

Can cost moneyThe rules say

Leaked keys get quarantined

If an access key appears publicly, AWS attaches a deny policy (AWSCompromisedKeyQuarantineV3) to limit fraud and opens a support case; you still pay for anything an attacker ran. Never commit keys to a repo. [8]

Can cost moneyPeople report

In a security researcher's test, AWS quarantined a key about 10 seconds after it was pushed to a public GitHub repository. [9]

Can cost moneyThe rules say

Free plan accounts close after 6 months

On the Free plan the account closes 6 months after opening or when credits run out, whichever comes first, unless you upgrade to the Paid plan. On the Paid plan usage beyond credits is billed pay-as-you-go. [6]

Worth knowingThe rules say

Root MFA is mandatory

All AWS account types must have MFA on the root user; register it within 35 days of the first console sign-in attempt. [3]

What you end up with

Env varSecretFormatWhat it is
AWS_ACCESS_KEY_IDsecretAKIA…Access key id of the IAM user (only when the access-key step is used).
AWS_SECRET_ACCESS_KEYsecret40-character secretSecret access key of the IAM user; shown once at creation.
AWS_REGIONnot secreteu-west-2Default AWS Region for SDKs and the CLI, e.g. eu-west-2.
AWS_ACCOUNT_IDnot secret12 digits12-digit AWS account id.

Renewals

  • Upgrade from the Free plan to the Paid plan (or the account closes): every 6 months after account creation (one-off) [6]
  • Rotate any long-term IAM user access keys: every when needed (e.g. when someone leaves); AWS gives no fixed period [5]

Pricing

  • Free tier: New accounts get $100 in credits plus up to $100 more for exploring services (up to $200), usable for up to 6 months on the Free plan; over 30 Always Free services within monthly limits.
  • Costs: Pay-as-you-go per service on the Paid plan once credits are used.

Source [6]

For agents

The same entry as JSON: /api/v1/entries/aws/account-and-iam · requirements /api/v1/requirements/aws/account-and-iam · terms /api/v1/terms/aws/account-and-iam.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for AWS account, root MFA and IAM access, and how long will it take?"
  → tools/call requirements { "provider_id": "aws/account-and-iam" }

Sources

  1. Create an AWS account - AWS Account Management Sign-up flow (payment method, phone verification, support plan, Complete sign up); activation "usually takes a few minutes but can sometimes take up to 24 hours"; confirmation email; Complete Sign Up button may still show while activating. · accessed 25 October 2026 · official
  2. AWS re:Post Knowledge Center - create and activate an AWS account Order of sign-up (payment, phone identity check, support plan); India-based accounts may need additional verification. Seen via search summary; direct fetch returned 403. · accessed 25 October 2026 · official
  3. Multi-factor authentication for AWS account root user - IAM User Guide All account types require root user MFA; register MFA within 35 days of first console sign-in attempt if not enabled; passkeys/security keys recommended. · accessed 25 October 2026 · official
  4. AWS IAM now enforces MFA for root users across all account types (What's New, June 2025) Root MFA enforcement timeline (standalone accounts from June 2024, all account types announced June 2025). · accessed 25 October 2026 · official
  5. Security best practices in IAM Humans should use federation / IAM Identity Center with temporary credentials; workloads should use roles; long-term access keys only where needed (third-party clients, workloads that cannot use roles) and rotated; least privilege; protect root credentials. · accessed 25 October 2026 · official
  6. AWS Free Tier New accounts get $100 credits plus up to $100 more (up to $200); Free plan lasts up to 6 months and the account closes after 6 months or when credits run out unless upgraded to a Paid plan; Free plan limited to select services; Paid plan pay-as-you-go. · accessed 25 October 2026 · official
  7. AWS Acceptable Use Policy Prohibits illegal/fraudulent use, security violations, unsolicited mass email or messages; AWS may investigate and remove or disable access to violating content or resources. · accessed 25 October 2026 · official
  8. AWSCompromisedKeyQuarantineV3 - AWS Managed Policy AWS attaches a deny policy to an IAM user whose credentials are exposed publicly to limit fraud; do not remove it, follow the support case instructions. · accessed 25 October 2026 · official
  9. Unit 42 - detecting exposed AWS IAM credentials Test where a key pushed to a public GitHub repo was quarantined by AWS about 10 seconds later. · accessed 25 October 2026 · community

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. Amazon Web Services is not affiliated with verapli.