# AWS now requires MFA on every account’s root user: register a passkey and keep the recovery email reachable

> AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console sign-in attempt. AWS recommends passkeys or security keys, and Organizations can centrally remove member-account root credentials.

- Canonical URL: https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-18T21:00:53+00:00
- Modified: 2026-10-18T22:22:07+00:00
- Last reviewed by DSE: 2026-10-18
- Resource type: Briefing
- DSE priority: Important
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console sign-in attempt. AWS recommends passkeys or security keys, and Organizations can centrally remove member-account root credentials.

## Potentially affected

Organizations with any AWS account, including small accounts used for backups, website hosting or a single application, and managed service providers who administer client AWS accounts.

## DSE recommendation

DSE recommends registering a phishing-resistant passkey or security key on every AWS root user and documenting who holds it and how recovery works.

## Article

AWS documentation says standalone, management and member accounts all require MFA on the root user, registered within 35 days of the first console sign-in attempt. AWS recommends passkeys or security keys, and Organizations can centrally remove member-account root credentials.

## Source facts

AWS’s [root user MFA documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html) says all AWS account types, standalone, management and member accounts, require MFA to be configured for their root user. Users must register MFA within 35 days of their first sign-in attempt to the console if it is not already enabled.

AWS recommends a passkey or security key wherever possible because they are more resistant to attacks such as phishing, and recommends FIDO security keys over hardware TOTP tokens for physical devices. A single security key can support multiple root and IAM users.

Before enabling MFA, AWS says to update the account’s email and phone details, because they are used to verify identity if the MFA device is lost. Accounts in AWS Organizations may be able to centrally manage root access and delete member-account root credentials, preventing root sign-in, password recovery and MFA setup.

## Applicability

Use this for every AWS account you own or manage. Enabling MFA on the root user does not protect IAM users or federated identities, which need their own controls.

## DSE recommendation

DSE recommends registering a phishing-resistant passkey or security key on every AWS root user and documenting who holds it and how recovery works. Point the root email at a monitored shared mailbox rather than a former employee’s address, keep a second key in a safe, and in multi-account organizations consider removing member-account root credentials centrally and using delegated access instead.

## Verification

Check each account’s root MFA status in the console or credential report quarterly, confirm the root email and phone reach current staff, and record the key holders and storage location in the access register.

## Official reference

[AWS Identity and Access Management User Guide — Multi-factor authentication for AWS account root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html). Reviewed October 18, 2026.

## Primary reference

- Name: AWS Identity and Access Management User Guide — Multi-factor authentication for AWS account root user
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “AWS now requires MFA on every account’s root user: register a passkey and keep the recovery email reachable,” DSE Security, https://update.dsesecurity.com/updates/aws-root-user-mfa-required-35-days-passkeys-central-root-access/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.