11–13 of 13 posts
You can use the TOTP 6 digit code method, but instead of just scanning the QR code with your phone, you save the “serial” in your password manager and then all your employees can add that serial to the app on their device. Did that make sense? That’s what I do.
You can use the TOTP 6 digit code method, but instead of just scanning the QR code with your phone, you save the “serial” in your password manager and then all your employees can add that serial to the app on their device. Did that make sense? That’s what I do.
Are you advocating that everyone can log into the root account? Or maybe I’m not completely understanding here.
No, there's no good answer to this. Don't ever use the Root account itself. Use a corporate Yubikey, kept in a safe or better yet - Corporate Safety Deposit Box - that only the highest-level technical leads (3-5) have access to and keys to. You should be using IAM user accounts for everything else. Unprivileged base users with access to two different roles. One for general use, one that has administrator access. Buil…
Yes, you are totally correct. We don't use our root account now, and we keep our our corporate Yubikeys in a safe with a 2-key access lock. The issue is that fewer and fewer people have access to the safe due to geography. I'm worried about our in-city bus factor.
Remember that if all else fails, AWS will send your company a physical letter that support will verify and unlock your account.