{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/aws-root-user-mfa-required-35-days-passkeys-central-root-access/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/",
        "slug": "aws-root-user-mfa-required-35-days-passkeys-central-root-access",
        "url": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/aws-root-user-mfa-required-35-days-passkeys-central-root-access/"
        },
        "title": "AWS now requires MFA on every account’s root user: register a passkey and keep the recovery email reachable",
        "summary": "AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console sign-in attempt. AWS recommends passkeys or security keys, and Organizations can centrally remove member-account root credentials.",
        "format": {
            "slug": "briefing",
            "name": "Briefing"
        },
        "priority": {
            "slug": "important",
            "name": "Important"
        },
        "featured": false,
        "image": {
            "theme": "identity-cloud",
            "label": "Identity & cloud",
            "alt": "Governed cloud identity system with connected service and lifecycle nodes.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-18T21:00:53+00:00",
        "modified_at": "2026-10-18T22:22:07+00:00",
        "reviewed_on": "2026-10-18",
        "reading_minutes": 2,
        "word_count": 326,
        "potentially_affected": "Organizations with any AWS account, including small accounts used for backups, website hosting or a single application, and managed service providers who administer client AWS accounts.",
        "dse_recommendation": "DSE recommends registering a phishing-resistant passkey or security key on every AWS root user and documenting who holds it and how recovery works.",
        "primary_source": {
            "name": "AWS Identity and Access Management User Guide — Multi-factor authentication for AWS account root user",
            "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console sign-in attempt. AWS recommends passkeys or security keys, and Organizations can centrally remove member-account root credentials.</p>\n<h2>Source facts</h2>\n<p>AWS’s <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html\">root user MFA documentation</a> says all AWS account types, standalone, management and member accounts, require MFA to be configured for their root user. Users must register MFA within 35 days of their first sign-in attempt to the console if it is not already enabled.</p>\n<p>AWS recommends a passkey or security key wherever possible because they are more resistant to attacks such as phishing, and recommends FIDO security keys over hardware TOTP tokens for physical devices. A single security key can support multiple root and IAM users.</p>\n<p>Before enabling MFA, AWS says to update the account’s email and phone details, because they are used to verify identity if the MFA device is lost. Accounts in AWS Organizations may be able to centrally manage root access and delete member-account root credentials, preventing root sign-in, password recovery and MFA setup.</p>\n<h2>Applicability</h2>\n<p>Use this for every AWS account you own or manage. Enabling MFA on the root user does not protect IAM users or federated identities, which need their own controls.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends registering a phishing-resistant passkey or security key on every AWS root user and documenting who holds it and how recovery works. Point the root email at a monitored shared mailbox rather than a former employee’s address, keep a second key in a safe, and in multi-account organizations consider removing member-account root credentials centrally and using delegated access instead.</p>\n<h2>Verification</h2>\n<p>Check each account’s root MFA status in the console or credential report quarterly, confirm the root email and phone reach current staff, and record the key holders and storage location in the access register.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html\">AWS Identity and Access Management User Guide — Multi-factor authentication for AWS account root user</a>. Reviewed October 18, 2026.</p>",
        "content_text": "AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console sign-in attempt. AWS recommends passkeys or security keys, and Organizations can centrally remove member-account root credentials.\nSource facts\nAWS’s root user MFA documentation says all AWS account types, standalone, management and member accounts, require MFA to be configured for their root user. Users must register MFA within 35 days of their first sign-in attempt to the console if it is not already enabled.\nAWS recommends a passkey or security key wherever possible because they are more resistant to attacks such as phishing, and recommends FIDO security keys over hardware TOTP tokens for physical devices. A single security key can support multiple root and IAM users.\nBefore enabling MFA, AWS says to update the account’s email and phone details, because they are used to verify identity if the MFA device is lost. Accounts in AWS Organizations may be able to centrally manage root access and delete member-account root credentials, preventing root sign-in, password recovery and MFA setup.\nApplicability\nUse this for every AWS account you own or manage. Enabling MFA on the root user does not protect IAM users or federated identities, which need their own controls.\nDSE recommendation\nDSE recommends registering a phishing-resistant passkey or security key on every AWS root user and documenting who holds it and how recovery works. Point the root email at a monitored shared mailbox rather than a former employee’s address, keep a second key in a safe, and in multi-account organizations consider removing member-account root credentials centrally and using delegated access instead.\nVerification\nCheck each account’s root MFA status in the console or credential report quarterly, confirm the root email and phone reach current staff, and record the key holders and storage location in the access register.\nOfficial reference\nAWS Identity and Access Management User Guide — Multi-factor authentication for AWS account root user. Reviewed October 18, 2026.",
        "content_markdown": "AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console sign-in attempt. AWS recommends passkeys or security keys, and Organizations can centrally remove member-account root credentials.\n\n## Source facts\n\nAWS’s [root user MFA documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html) says all AWS account types, standalone, management and member accounts, require MFA to be configured for their root user. Users must register MFA within 35 days of their first sign-in attempt to the console if it is not already enabled.\n\nAWS recommends a passkey or security key wherever possible because they are more resistant to attacks such as phishing, and recommends FIDO security keys over hardware TOTP tokens for physical devices. A single security key can support multiple root and IAM users.\n\nBefore enabling MFA, AWS says to update the account’s email and phone details, because they are used to verify identity if the MFA device is lost. Accounts in AWS Organizations may be able to centrally manage root access and delete member-account root credentials, preventing root sign-in, password recovery and MFA setup.\n\n## Applicability\n\nUse this for every AWS account you own or manage. Enabling MFA on the root user does not protect IAM users or federated identities, which need their own controls.\n\n## DSE recommendation\n\nDSE recommends registering a phishing-resistant passkey or security key on every AWS root user and documenting who holds it and how recovery works. Point the root email at a monitored shared mailbox rather than a former employee’s address, keep a second key in a safe, and in multi-account organizations consider removing member-account root credentials centrally and using delegated access instead.\n\n## Verification\n\nCheck each account’s root MFA status in the console or credential report quarterly, confirm the root email and phone reach current staff, and record the key holders and storage location in the access register.\n\n## Official reference\n\n[AWS Identity and Access Management User Guide — Multi-factor authentication for AWS account root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html). Reviewed October 18, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/",
                "url": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-18"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "AWS now requires MFA on every account’s root user: register a passkey and keep the recovery email reachable",
                        "item": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/#article",
                "identifier": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/",
                "url": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/",
                "headline": "AWS now requires MFA on every account’s root user: register a passkey and keep the recovery email reachable",
                "description": "AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console…",
                "abstract": "AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console sign-in attempt. AWS recommends passkeys or security keys, and Organizations can centrally remove member-account root credentials.",
                "articleBody": "AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console sign-in attempt. AWS recommends passkeys or security keys, and Organizations can centrally remove member-account root credentials.\nSource facts\nAWS’s root user MFA documentation says all AWS account types, standalone, management and member accounts, require MFA to be configured for their root user. Users must register MFA within 35 days of their first sign-in attempt to the console if it is not already enabled.\nAWS recommends a passkey or security key wherever possible because they are more resistant to attacks such as phishing, and recommends FIDO security keys over hardware TOTP tokens for physical devices. A single security key can support multiple root and IAM users.\nBefore enabling MFA, AWS says to update the account’s email and phone details, because they are used to verify identity if the MFA device is lost. Accounts in AWS Organizations may be able to centrally manage root access and delete member-account root credentials, preventing root sign-in, password recovery and MFA setup.\nApplicability\nUse this for every AWS account you own or manage. Enabling MFA on the root user does not protect IAM users or federated identities, which need their own controls.\nDSE recommendation\nDSE recommends registering a phishing-resistant passkey or security key on every AWS root user and documenting who holds it and how recovery works. Point the root email at a monitored shared mailbox rather than a former employee’s address, keep a second key in a safe, and in multi-account organizations consider removing member-account root credentials centrally and using delegated access instead.\nVerification\nCheck each account’s root MFA status in the console or credential report quarterly, confirm the root email and phone reach current staff, and record the key holders and storage location in the access register.\nOfficial reference\nAWS Identity and Access Management User Guide — Multi-factor authentication for AWS account root user. Reviewed October 18, 2026.",
                "datePublished": "2026-10-18T21:00:53+00:00",
                "dateModified": "2026-10-18T22:22:07+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "AWS now requires MFA on every account’s root user: register a passkey and keep the recovery email reachable"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Briefing",
                    "Important priority"
                ],
                "genre": "Briefing",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 326,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS Identity and Access Management User Guide — Multi-factor authentication for AWS account root user",
                    "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html"
                }
            }
        ]
    }
}