Remove MFA from a root account

Question

We need to login with our root account, in order to clear a policy on a S3 bucket that a user made. However, we are unable to login as our root account, even after successfully reseting the password, and using the MFA we have associated with it. Not sure if our MFA for the root has an issue, as we tried resyncing it too. It has been a couple of years since we logged in with the root account/MFA.

How can we get the MFA removed from the root account on our account so that we can log in and re-add it?

Dexter - AWS · Answer

Hi,

After you've successfully signed in using your password, you'll be presented with an MFA prompt. At the bottom of this page, click the "Troubleshoot MFA" link below the text box.
Provide your root user's email and you'll get a link to remove the MFA from the account. When you click on the link, it will open up the option to use a one-time code as your temporary MFA token to login to AWS.

https://aws.amazon.com/blogs/security/reset-your-aws-root-accounts-lost-mfa-device-faster-by-using-the-aws-management-console/

Antonio_Lagrotteria · Answer

Hi,

I would suggest to follow this guide: https://repost.aws/knowledge-center/reset-root-user-mfa.

If unsuccessful, you should then contact Support, just to prove you are the owner of the account.

Hope it help ;)

Harish Mandhadi · Answer

Leverage central root access management feature and you dont need to have root credentials. If you enable central root access management you can delete the s3 bucket policy from management account. Check this https://repost.aws/articles/ARIppLTq8lTaifWGqxGfAaDg/securing-the-cloud-the-evolution-and-future-of-aws-root-access-management-mfa-integration-and-mfa-adoption-timelines-for-enhanced-security-design
https://aws.amazon.com/blogs/security/secure-root-user-access-for-member-accounts-in-aws-organizations/

Remove MFA from a root account

Relevant content