Centrally managing root access for customers using AWS Organizations

This article discusses a new AWS capability that allows centralized management of root access for accounts in AWS Organizations, addressing longstanding challenges in managing highly privileged root credentials across multiple accounts.

Specifically, the article covers:

• The challenges of manually managing root credentials at scale, including security risks, operational overhead, and compliance issues.
• The new ability to centrally manage root credentials, including removing long-term root credentials, preventing credential recovery, and provisioning secure-by-default accounts.
• Root sessions, which provide short-term, task-scoped root access for specific actions like unlocking S3 bucket policies or SQS queue policies, without needing long-term root credentials.
• A demo showing how to enable and use the new capabilities, including creating a member account without root credentials, obtaining temporary root credentials, and performing a restricted API call as root.
• The availability and documentation of the new features.