Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Still locked out of my AWS account

docs.google.com

Post reply on HN
Print view View original

111–120 of 283 posts

Re: Still locked out of my AWS account

#111

Post by coleca »

Some great advice in here about creating multiple accounts with a + sign in the email address. One thing I didn't see mentioned that is a standard best practice for AWS is to create a separate IAM account for your day to day usage and NEVER log into your root account (unless you need to open a billing support ticket) after creating the IAM account.

You will get a new login page and username to log in with and not need an email address specific account.

http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practic...

Re: Still locked out of my AWS account

#114

Post by tqkxzugoaupvwqr »

colemorrison wrote: post #81
mirekrusin wrote: post #70

Also having problem with AWS - can't access it and they keep billing me for something there I want to shut it down (EC2?) but I can't. I recently moved from Brazil to UK (new address) and changed phone + sim card (Authenticator after restore from backup lost all 2 factor auth entries). This is the moment when you realise that you're outside of predefined use cases of The Machine and you're fucked. Nobody is here to h…

I had 2FA activated, changed phones and lost it. I couldn't log in to my account, so I contacted support. Within about 30 min they had put me back into my account. The dude who helped me was super chill and understanding as well.

What is the purpose of 2FA when social engineering the support team circumvents it? This should not be possible! Lost your phone? That’s what 2FA backup codes are for.

Re: Still locked out of my AWS account

#115

Post by Twirrim »

falcolas wrote: post #105
Twirrim wrote: post #77

Earlier quoted context omitted.

In all seriousness, email jeff@amazon.com. The most likely outcome is that some relevant managers will receive one of the infamous "?" emails from him. If so, that'll result in two things: 1) Your problem will be resolved ASAP, managers right up the chain will be tracking it extremely closely, as they'll have to justify every action to Jeff. Everyone goes scrambling when one of those emails goes out. 2) A post-mortem…

I think that's gone the way of the dodo. Last I remember, he didn't read those anymore, and they were automatically just shunted into the normal escalation flow. Too many people got wind of it and abused it.

It was certainly still active and being triggered by Jeff not long before I left Amazon (just over a year ago now), I used to be subscribed to the list where those post-mortems would appear, and they would always indicate how the escalation occurred.

Re: Still locked out of my AWS account

#116

Post by ceejayoz »

e59d134d wrote: post #65
ceejayoz wrote: post #28

Earlier quoted context omitted.

By "self-host", don't you mean "rely on a landlord / ISP / colocation facility"?

Back in days we rented servers and created our env, it was not really that hard. And it was super easy to move from one provider to another.

> Back in days we rented servers

As you do with AWS...

> and created our env

As you do with AWS...

> And it was super easy to move from one provider to another.

Which is easier on cloud hosting than it ever was when dealing with colocation providers.

Re: Still locked out of my AWS account

#117

Post by jethro_tell »

willow9886 wrote: post #57
MichaelGG wrote: post #51

Earlier quoted context omitted.

Because you're unlikey to trigger a violation on your cloud SaaS account, but could easily run afoul of other policies like "Real Name" or "Bought a Pixel Phone and Sold It" or posting something "offensive", getting reported by other users, etc. If the account is just for a cloud SaaS, then there's likely to be very few policies to disable your account.

But then you're storing passwords in more services, which creates more surface area for breaches. If you shop with Amazon, host your services with Amazon, watch TV on Amazon...there's simply no way of getting around the fact that Amazon will only want to manage a password for you in one place. The issue is clearly over reliance on Amazon services.

Uh, Sure, if you have one account. The point being that if you're smart, you isolate every account. myaccount-aws@domain and myaccount-retail@domain and then turn off cloud services for retail account and turn on two factor auth for saas.

That's on you. You can't get the benifit of separation if you have them do it for you.

In the same way you get one company to own your domain and one to run your email. That way when your email provider decides you're a spammer or your account get's closed for uploading a bad app to the android store, you can go else where and swap your dns.

Re: Still locked out of my AWS account

#118

Post by stephengillie »

kbullaughey wrote: post #113

Any references to how one should go about separating an Amazon retail account and an AWS account, if they are presently the same?

The best option I know is rebuilding your services in a new AWS account. That will let you can keep using the same Amazon retail account as before, and transfer your assets in AWS to an account tied to your production organization.

CloudFormer[0] might be able to automate some of the process - it analyzes your existing VPC and generates a CloudFormation[1] template. You could then take this template and deploy the stack in your new account, and you'd only have to rebuild the remaining few items.

Then you could redeploy all your applications, test, and migrate production services to your freshly-tested instance. Finally, you must be aggressive in shutting down the old services. It would be agonizing to have your entire site down because one server remains in the old account, and the account had some issue. Feel free to contact me for more specific advice.

[0] https://www.linkedin.com/pulse/how-why-use-aws-cloudformer-a...

[1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...

Re: Still locked out of my AWS account

#119

Post by ianhawes »

markaius wrote: post #104

[Deleted]

Please delete your comment.

I am incredibly happy that Digital Ocean made you go to those lengths to get your account back. The last thing we need is web services companies requiring less security. Social engineering attacks are typically the method of entry to hosting providers such as Digital Ocean.

Frankly I would be totally fine if they required another form of ID (such as a passport) or another form of address/name verification (such as a utility bill). Or perhaps even a picture of the card on file.

What is NOT okay is a lack of response, which this article is describing.

Re: Still locked out of my AWS account

#120

Post by stedaniels »

joelrunyon wrote: post #27
colinmeinke wrote: post #2

8 days ago I tried to log in to my Amazon retail account, and received a password invalid error. As it turned out my account had been closed, as it appeared to Amazon that it had received a suspicious log in. This is the same account that I use for AWS - hosting websites critical to my business. Today it appears I am no closer to gaining access back to my AWS account than I was on day 1, even though I have been bille…

This happened to me with instagram. I reset a password, then they detected "suspicious activity." I clicked "send pin via email" and the email never shows up. I've done it 3 or 4 times over the course of a week + it never works. It's a documented error + FB/Instagram refuse to addres it. https://medium.com/@joelrunyon/instagrams-security-features-...

Took me weeks to get back an Instagram account that was locked as soon as I signed up, with a phone number too. Half the forms that are meant to help you are actually broken and 500 error most of the time. After many emails I ended up having to send a photo of myself holding a sign with the username and some random code on it. So bizarre. It's not like Facebook don't know my entire life history, but hoops still had to be jumped through!
Post reply on HN