Sign in for AWS

This guide helps you understand the different ways that you can sign in to Amazon Web Services (AWS). You can sign in to AWS in the following ways:

For more information comparing our new sign up experience and the existing AWS experience, see Compare sign-up options.

If you have issues signing in to AWS, see the troubleshooting documentation for each way to sign in:

For more information about how signing up for AWS can help you or your organization, see Contact Us.

Terminology

Amazon Web Services (AWS) uses common terminology to describe the sign in process. We recommend you read and understand these terms.

Administrator

Also referred to as an AWS account administrator or IAM administrator. The administrator, typically Information Technology (IT) personnel, is an individual who oversees an AWS account. Administrators have a higher level of permissions to the AWS account than other members of their organization. Administrators establish and implement settings for the AWS account. They also create IAM or IAM Identity Center users. The administrator provides these users with their access credentials and a sign-in URL to sign in to AWS.

An administrator is only supported if you sign in with Sign up for AWS (advanced).

Account

A standard AWS account contains both your AWS resources and the identities that can access those resources. Accounts are associated with the account owner’s email address and password.

Credentials

Also referred to as access credentials or security credentials. In authentication and authorization, a system uses credentials to identify who is making a call and whether to allow the requested access. Credentials are the information that users provide to AWS to sign in and gain access to AWS resources. Credentials for human users can include an email address, a user name, a user defined password, an account ID or alias, a verification code, and a single use multi-factor authentication (MFA) code. For programmatic access, you can also use access keys. We recommend using short-term access keys when possible.

For more information about credentials, see AWS security credentials.

Corporate credentials

The credentials that users provide when accessing their corporate network and resources. Your corporate administrator can set up your AWS account to use the same credentials that you use to access your corporate network and resources. These credentials are provided to you by your administrator or help desk employee.

Corporate credentials are only supported if you sign in with Sign up for AWS (advanced).

Profile

When you sign up for an AWS Builder ID or use our new AWS experience, you create a profile. Your profile includes the contact information you provided and the ability to manage multi-factor authentication (MFA) devices and active sessions. You can also learn more about privacy and how we handle your data in your profile. For more information about how your Builder ID relates to an AWS account, see AWS Builder ID and other AWS credentials.

Root user credentials

The root user credentials are the email address and password used to create the AWS account. We strongly recommend that MFA be added to the root user credentials for additional security. Root user credentials provide complete access to all AWS services and resources in the account. For more information on the root user, see Root user.

Root user credentials are only supported if you sign in with Sign up for AWS (advanced).

User

A user is a person or application that has permissions to make API calls to AWS products or to access AWS resources. Each user has a unique set of security credentials that aren't shared with other users. These credentials are separate from the security credentials for the AWS account. For more information, see Determine your user type.

Verification code

A verification code verifies your identity during the sign-in process using multi-factor authentication (MFA). The delivery methods for verification codes varies. They can be sent via text message or email. Check with your administrator for more information.

Region availability for AWS Sign-In

Sign up for AWS (advanced) is available in several commonly used AWS Regions. This availability makes it easier for you to access AWS services and business applications. For a full list of the Regions that Sign-In supports, see AWS Sign-In endpoints and quotas.

If you use our new AWS experience, only US East (Ohio) (us-east-2), Europe (Stockholm) (eu-north-1), and Asia Pacific (Sydney) (ap-southeast-2) are supported. For more information, see AWS Regions for your projects.

AWS Builder ID is available in US East (N. Virginia). Applications that use AWS Builder ID may operate in other Regions.

Sign-in event logging

CloudTrail is automatically enabled on your AWS account and records events when activity occurs. The following resources can help you learn more about logging and monitoring sign-in events.

AWS Sign-In supports resource-based policies and resource control policies that enable you to restrict console access based on network location and principal identity. For root users, network location is validated before the password prompt appears. For all principal types, policies are evaluated at pre-authentication and post-authentication. For more information, see Controlling console access with resource-based policies and resource control policies.

AWS Sign-In logs policy evaluation events to CloudTrail. When a resource-based policy or resource control policy (RCP) denies access during sign-in, CloudTrail records the evaluation result, including the policy statements that were evaluated and the final decision (allow or deny). Use these logs to monitor unauthorized access attempts and troubleshoot policy configuration issues. For more information, see Monitor and audit continuously.

The following example shows a CloudTrail event for a failed console login attempt denied by a resource-based policy:

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDACKCEVSQ6C2EXAMPLE",
    "arn": "arn:aws:iam::111122223333:user/ExampleUser",
    "accountId": "111122223333",
    "userName": "ExampleUser"
  },
  "eventTime": "2026-02-18T21:19:28Z",
  "eventSource": "signin.amazonaws.com",
  "eventName": "ConsoleLogin",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "[IP_ADDRESS]",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) ...",
  "errorCode": "AccessDenied",
  "errorMessage": "Authorization denied because of a resource-based policy",
  "requestParameters": null,
  "responseElements": {
    "ConsoleLogin": "Failure"
  },
  "additionalEventData": {
    "LoginTo": "https://console.aws.amazon.com/console/home?region=us-east-1",
    "MobileVersion": "No",
    "MFAUsed": "No"
  },
  "eventID": "db26d1f9-ce73-4dd9-9081-cdf2aEXAMPLE",
  "readOnly": false,
  "eventType": "AwsConsoleSignIn",
  "managementEvent": true,
  "recipientAccountId": "111122223333",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "signin.aws.amazon.com"
  }
}

This CloudTrail event shows a failed console login attempt where access was denied by a resource-based policy. The errorMessage field indicates the policy type that caused the denial: "Authorization denied because of a resource-based policy" for resource-based policy, or "Authorization denied because of a resource control policy" for RCPs. The event captures the IAM user identity, timestamp, source IP address, and login destination.

CloudTrail generates events for both pre-authentication denials (when AWS Sign-In blocks the credential page for root users) and post-authentication denials (when a policy denies access after credentials are validated).