AWS GovCloud (US) account root user

When you first create a standard AWS account (not an AWS GovCloud (US) account), you begin with one identity that has complete access to all AWS services and resources in the account. This identity is called the AWS account root user. You can sign in as the root user using the email address and password that you used to create the account.

When you finish the AWS GovCloud (US) Sign Up process and your AWS GovCloud (US) account is created, the AWS GovCloud (US) account root user is also created at that time. Unlike the conclusion of the standard AWS account sign up process, you cannot sign-in to the AWS Management Console for AWS GovCloud (US) using your account email address and password. Depending on the method you used to sign up, you are provided initial console access to your AWS GovCloud (US) account via either an Administrator IAM user or the OrganizationAccountAccessRole IAM role.

While AWS GovCloud (US) account root user console access is not supported, programmatic access keys are supported. Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK).

Anyone who has root user access keys for your AWS GovCloud (US) account has unrestricted access to all the resources in your account.

In this guide you will find...

Does my AWS GovCloud (US) account have existing root access keys?

As an AWS GovCloud (US) account administrator, you may want to know if there are root access keys in your AWS GovCloud (US) account.

Method 1

You can generate and download a credential report that lists all users in your account and the status of their various credentials, including passwords, access keys, and MFA device from your AWS GovCloud (US) account.

To get your credential report, see Getting credential reports for your AWS account in the AWS Identity and Access Management User Guide.

In the credential report CSV, the following columns will allow you to identify if you have root access keys in your account and if they are active.

In this example, the root user has an active root access key in the account because the access_key_1_last_rotated field is not marked N/A and the access_key_1_active field is marked TRUE. You can also see there is not a second access key associated with the root user because access_key_2_last_rotated field is marked N/A. Since there is not a second access key access_key_2_active field is marked FALSE.

For info on removing root user access keys, see Deleting my AWS GovCloud (US) account root user access keys.

Method 2

If AWS Security Hub is enabled on your account, the following Security Hub controls have a Failed compliance status when root access keys exist in your AWS GovCloud (US) account.

For more information on AWS Security Hub, see the AWS Security Hub User Guide.

To remediate these findings, see Deleting my AWS GovCloud (US) account root user access keys.

Requesting root access keys for an AWS GovCloud (US) account

AWS GovCloud (US) account root user access keys can be requested from AWS Support. Once your request is processed and approved, any existing AWS GovCloud (US) account root user access keys in your AWS GovCloud (US) account will be deleted, followed by the creation of a single new access key. This new access key will stored as an encrypted secret with AWS Secrets Manager and AWS KMS in the US East (N. Virginia) Region. This secret is made available exclusively to the root user of the standard AWS account associated with your AWS GovCloud (US) account.

AWS managed account for this process: 536883072436.

Use the following guide to request and retrieve a new AWS GovCloud (US) account root user access key.

Prerequisites

This task requires root access to the standard AWS account associated with your AWS GovCloud (US) account.

If your AWS GovCloud (US) account is in an AWS GovCloud (US) Organization and has a service control policy (SCP) applied to the AWS GovCloud (US) account that disallows actions as the root user or prevents the creation of root access keys, your AWS GovCloud (US) Organization management account will need to adjust the SCP before you can request AWS GovCloud (US) account root access keys. Specifically they will need to allow the following actions from the root user:

For AWS GovCloud (US) Organization Management Account Administrators

The following SCP meets the minimum requirements to process a request for AWS GovCloud (US) account root user access keys while disallowing all other actions from the AWS GovCloud (US) account root user.

This is useful in the situation where a member account may have forgot or lost their existing AWS GovCloud (US) account root user access keys and you would like to prevent them from being used to take actions against account resources until AWS Support can process your request for new AWS GovCloud (US) account root user access keys.

{
                        "Version": "2012-10-17",
                        "Statement": [{
                            "Sid": "AccessKeyManagementOnly",
                            "Effect": "Deny",
                            "NotAction": [
                                "iam:DeleteAccessKey",
                                "iam:CreateAccessKey",
                                "iam:ListAccessKeys"
                            ],
                            "Resource": [
                                "*"
                            ],
                            "Condition": {
                                "StringLike": {
                                    "aws:PrincipalArn": [
                                        "arn:aws-us-gov:iam::*:root"
                                    ]
                                }
                            }
                        },
                        {
                            "Sid": "RootUserAccessKeyManagementOnly",
                            "Effect": "Deny",
                            "Action": [
                                "iam:DeleteAccessKey",
                                "iam:CreateAccessKey",
                                "iam:ListAccessKeys"
                            ],
                            "Resource": [
                                "arn:aws-us-gov:iam::*:user/*"
                            ],
                            "Condition": {
                                "StringLike": {
                                    "aws:PrincipalArn": [
                                        "arn:aws-us-gov:iam::*:root"
                                    ]
                                }
                            }
                        }
                    ]
                }

Troubleshooting

These are some of the most common issues you may face while retrieving your AWS GovCloud (US) account root user access keys.

Issue: DecryptionFailure

$ aws secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:us-east-1:536883072436:secret:abcDEfgHiJKLMno-abcDeF 
--region us-east-1 --version-stage AWSCURRENT --output text --query 'SecretString'
An error occurred (DecryptionFailure) when calling the GetSecretValue operation: 
Secrets Manager can't decrypt the secret value: arn:aws:kms:us-east-1:536883072436:key/73947a77-ddbe-4dc7-bd8f-3fe0bc840778 is disabled. 
(Service: AWSKMS; Status Code: 400; Error Code: DisabledException; Request ID: cdc4b7ed-e171-4cef-975a-ad829d4123e8; Proxy: null)                           
                        

Cause

Your AWS GovCloud (US) account root user access key have been successfully retrieved once.

Solution

If you lost or forgot your AWS GovCloud (US) account root user access keys from Step 3, you will need to start from Step 1 and submit a new support case. AWS Support will not be able to re-enable access to the access keys generated in the original support case.

Issue: AccessDeniedException

$ aws secretsmanager get-secret-value --secret-id arn:aws:secretsmanager:us-east-1:536883072436:secret:abcDEfgHiJKLMno-abcDeF 
--region us-east-1 --version-stage AWSCURRENT --output text --query 'SecretString'
An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:iam::123456789012:user/admin 
is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:us-east-1:536883072436:secret:abcDEfgHiJKLMno-abcDeF 
because no resource-based policy allows the secretsmanager:GetSecretValue action
                             

Cause

An IAM identity that was not the root user of the standard AWS account associated with your AWS GovCloud (US) account was used to run this command. For security purposes AWS will only allow the retrieval of your new AWS GovCloud (US) account root user access keys from the root user of the standard AWS account associated with your AWS GovCloud (US) account.

Solution

The AWS CLI in AWS CloudShell by default will assume the credentials of the user who is signed into the AWS Management Console. Sign in to the standard AWS account associated with your AWS GovCloud (US) account as the root user and run the provided command in AWS CloudShell.

Configure AWS GovCloud (US) account root user access keys in the AWS CLI (AWS CloudShell)

Before completing Tasks in AWS GovCloud (US) Regions that require root user access keys, you will need to configure the AWS CLI with your AWS GovCloud (US) account root user access keys. If you do not have AWS GovCloud (US) account root user access keys, see Requesting root access keys for an AWS GovCloud (US) account.

If you have just completed the steps to retrieve your AWS GovCloud (US) account root user access keys, you can continue to use AWS CloudShell in your standard AWS account as the AWS CLI is preinstalled. Alternatively, you can download the AWS CLI for local use.

A collection of settings in the AWS CLI is called a profile. By default, the AWS CLI uses the default profile. We recommend the creation and use of an additional named profile for storing these root access keys by specifying the --profile option and assigning a name.

The following example creates a profile named govcloudroot. This profile will be used in other examples throughout this guide.

$ aws configure --profile govcloudroot
        AWS Access Key ID [None]: AKIAI44QH8DHBEXAMPLE
        AWS Secret Access Key [None]: je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY
        Default Region name [None]: us-gov-west-1
        Default output format [None]: json                        
                    

$ aws sts get-caller-identity --profile govcloudroot --region us-gov-west-1
    {
        "UserId": "123456789012",
        "Account": "123456789012",
        "Arn": "arn:aws-us-gov:iam::123456789012:root"
    }                        
                    

AWS CLI security with AWS GovCloud (US) account root user access keys

The credentials used by the AWS CLI are stored in plaintext files and are not encrypted. The $HOME/.aws/credentials file stores long-term credentials required to access your AWS resources. These include your access key ID and secret access key.

AWS CLI security with AWS GovCloud (US) account root user access keys

Once you have completed Tasks in AWS GovCloud (US) Regions that require root user access keys, delete your AWS GovCloud (US) account root user access keys.

If you would like to retain your AWS GovCloud (US) account root user access keys, it is recommended to remove them from your AWS CLI credentials file. Store your access keys in a safe location until the next time you need them. To remove your root access keys from the credentials file, you can use the following methods.

Tasks in AWS GovCloud (US) Regions that require root user access keys

We recommend that you use an IAM user with appropriate permissions to perform tasks and access AWS resources. However, you can perform the tasks listed below only when you use the AWS GovCloud (US) account root user access keys. Configure AWS GovCloud (US) account root user access keys in the AWS CLI (AWS CloudShell) before starting these tasks.

Restore IAM Administrator access to the AWS Management Console for AWS GovCloud (US)

The most common use of AWS GovCloud (US) account root user access keys is to restore administrator access to the AWS GovCloud (US) console. In this section, you will learn how to restore AWS Management Console access for the Administrator IAM user in your AWS GovCloud (US) account using your AWS GovCloud (US) account root user access keys.

Any additional IAM administrative task not requiring AWS GovCloud (US) account root user access keys are recommended to be completed in the AWS GovCloud (US) console as the Administrator IAM user.

To learn how to sign in to the AWS GovCloud (US) console as an IAM user, see Sign in as an IAM user in the AWS GovCloud (US) User Guide.

Creating an Administrator IAM user and Administrators IAM group

Copy and paste the following AWS CLI commands into the terminal window to...

$ aws iam create-group --group-name Administrators --profile govcloudroot --region us-gov-west-1
                            $ aws iam attach-group-policy --group-name Administrators --policy-arn arn:aws-us-gov:iam::aws:policy/AdministratorAccess --profile govcloudroot --region us-gov-west-1
                            $ aws iam create-user --user-name Administrator --profile govcloudroot --region us-gov-west-1
                            $ aws iam add-user-to-group --user-name Administrator --group Administrators --profile govcloudroot --region us-gov-west-1
                         

Setting a new Administrator IAM user password

With the Administrator IAM user created you can now set a new password to access the AWS GovCloud (US) console. It is recommended you set a temporary password when using the AWS CLI and require the password to be changed once you sign in to the AWS GovCloud (US) console.

Copy and paste the following AWS CLI command into your terminal window to set a new temporary password for the Administrator IAM user. Sign in to the AWS GovCloud (US) console with the temporary password to set your new password for the Administrator IAM user.

$ aws iam create-login-profile --user-name Administrator --password-reset-required 
                            --profile govcloudroot --region us-gov-west-1 --password NewTempPasswordHere                            
                        

$ aws iam get-account-password-policy --profile govcloudroot --region us-gov-west-1                                
                            

Disabling an MFA device associated with the Administrator IAM user password

Use these commands to disassociate an MFA device from the Administrator IAM user and deactivate it. If the device is virtual, use the ARN of the virtual device as the serial number.

Edit or delete an Amazon S3 bucket policy for a bucket where I accidentally denied everyone access

During development or implementation of a new Amazon S3 bucket policy, you may accidentally deny access to the bucket for all IAM users in your AWS GovCloud (US) account. Use the following commands with your AWS GovCloud (US) account root user access keys to retrieve, replace, or delete the policy.

aws s3api get-bucket-policy

aws s3api get-bucket-policy --profile govcloudroot --region us-gov-west-1 --bucket my-bucket

aws s3api put-bucket-policy

aws s3api put-bucket-policy --profile govcloudroot --region us-gov-west-1 
--bucket my-bucket --policy file://policy.json

aws s3api delete-bucket-policy

aws s3api delete-bucket-policy --profile govcloudroot --region us-gov-west-1 --bucket my-bucket

Remediation of AWS Security Hub findings

The following AWS Security Hub findings can be remediated by deleting all root access keys in the AWS GovCloud (US) account. To learn how, see Deleting my AWS GovCloud (US) account root user access keys.

Rotate my AWS GovCloud (US) account root user access keys

It is recommended to not have AWS GovCloud (US) root access keys in your account. If you must keep one available, rotate (change) the access key regularly. You can rotate access keys from the AWS Command Line Interface using an active AAWS GovCloud (US) account root user access key.

Deleting my AWS GovCloud (US) account root user access keys

It is recommended to not have AWS GovCloud (US)) root access keys in your account. Use the following commands with your AWS GovCloud (US) account root user access keys to delete any additional root user access keys and itself.

Securing my AWS GovCloud (US) account root user access keys

Safeguard your AWS GovCloud (US) account root user access keys the same way you would protect other sensitive personal information. We don't recommend generating access keys for your root user, because they allow full access to all your resources for all AWS services. The root user in AWS GovCloud (US) does not support MFA. Don’t use your root user for everyday tasks. Use the root user to complete the tasks that only the root user can perform. For the complete list of these tasks, see Tasks in AWS GovCloud (US) Regions that require root user access keys in this guide. Listed here are best practices to secure your AWS GovCloud (US) account root access keys.

Transferring the root user owner

The associated standard AWS account root user is the AWS GovCloud (US) account owner. To transfer ownership of your AWS GovCloud (US) account, you will transfer ownership of the related standard AWS account root user, see How do I transfer my AWS account to another person or business?

The method to provide the new owner access to the AWS GovCloud (US) account should be coordinated prior to the transfer of ownership and in accordance to the agreements between the individuals or organizations making the transfer.

If the previous owner has transferred the standard AWS account root user to you without providing access to the related AWS GovCloud (US) account, you can request root access keys for the AWS GovCloud (US) account from AWS Support, see Requesting root access keys for an AWS GovCloud (US) account.