as a root account you should have 2FA enabled. But if you want a yubikey, you can only add one, with no fallback for a TOTP device - lose your yubikey and you're at the mercy of AWS support.
As a fallback for my spare Yubikeys, I have created a couple of dummy, web-only IAM users with root privileges.
Still an embarrassing UX failure on AWS’s side though.
The worst thing IMO is that the AWS API and the UI seems to be already designed with multiple 2FA devices in mind. I have absolutely zero idea what took them over the last years from implementing this absolutely basic feature.
For what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges.
Last I checked (and by that I mean found out the hard way) there are still places across AWS that you can lock everyone but root out of. Particularly it seems around a few of the places where you're configuring policies on specific resources rather than through IAM.
We ended up setting a policy on an S3 bucket that locked everyone out. The root account _always_ has permissions to edit/remove that policy, but the policy itself prevented the admin accounts from removing it.
Comments
Good points.
As a fallback for my spare Yubikeys, I have created a couple of dummy, web-only IAM users with root privileges.
Still an embarrassing UX failure on AWS’s side though.
The worst thing IMO is that the AWS API and the UI seems to be already designed with multiple 2FA devices in mind. I have absolutely zero idea what took them over the last years from implementing this absolutely basic feature.
For what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges.
Last I checked (and by that I mean found out the hard way) there are still places across AWS that you can lock everyone but root out of. Particularly it seems around a few of the places where you're configuring policies on specific resources rather than through IAM.
We ended up setting a policy on an S3 bucket that locked everyone out. The root account _always_ has permissions to edit/remove that policy, but the policy itself prevented the admin accounts from removing it.
You’re correct, those have the AdministratorAccess policy, not root. It’s been a while since I set those up.
For practical purposes, wouldn’t AdministratorAccess be sufficient to recover from a lost (root user’s) YubiKey?