AWS IAM documentation change
Summary
Expanded guidance on root user credential recovery and added required permissions
Security assessment
Improves documentation about securing root user access but does not address a specific vulnerability
Diff
diff --git a/IAM/latest/UserGuide/id_root-enable-root-access.md b/IAM/latest/UserGuide/id_root-enable-root-access.md index 3fe232830..7d424eeb6 100644 --- a/IAM/latest/UserGuide/id_root-enable-root-access.md +++ b/IAM/latest/UserGuide/id_root-enable-root-access.md @@ -13 +13,7 @@ After you centralize root access, you can choose to delete root user credentials -If you need to recover root user credentials for a member account, you can enable password recovery on the account. Some tasks can only be performed when you sign in as the root user of an account. Some of these [Tasks that require root user credentials](./id_root-user.html#root-user-tasks) can be performed by the management account or delegated administrator for IAM. We recommend deleting root user credentials once you complete the task that requires access to the root user. To learn more about privileged tasks you can perform, see [Perform a privileged task](./id_root-user-privileged-task.html). +###### Note + +While some [Tasks that require root user credentials](./id_root-user.html#root-user-tasks) can be performed by the management account or delegated administrator for IAM, some tasks can only be performed when you sign in as the root user of an account. + +If you need to recover root user credentials for a member account to perform one of these tasks, follow the steps in [Perform a privileged task](./id_root-user-privileged-task.html) and select **Allow password recovery**. The person with access to the root user email inbox for the member account can then follow the steps to [ reset the root user password](https://docs.aws.amazon.com/IAM/latest/UserGuide/reset-root-password.html) and sign in to the member account root user. + +We recommend deleting root user credentials once you complete the task that requires access to the root user. @@ -26,0 +33,2 @@ Before you centralize root access, you must have an account configured with the + * `iam:ListOrganizationsFeatures` + @@ -30,0 +39,2 @@ Before you centralize root access, you must have an account configured with the + * `organizations:ListAccountsForParent` +