For a small team, the AWS root user needs four things: a shared group email address, MFA with more than one device, no access keys, and an alert whenever it is used. Then split the recovery channels so no single person can take over the account alone.
Use a group email, not a founder's inbox
AWS recommends an address managed by the business that forwards to a group of people. If AWS needs to contact the account owner, this avoids delays when someone is away or has left. The address should not be used for anything else.
If the root email is a personal inbox of one founder, that person leaving, or that inbox being phished, becomes an account takeover path.
MFA, and more than one device
AWS requires MFA on the root user of all account types. You can register up to eight MFA devices of any mix of supported types, and AWS strongly recommends more than one for resilience. Options include FIDO certified hardware keys, hardware TOTP tokens and virtual authenticator apps.
For a team of five, a practical setup is two hardware keys held by two different people, stored apart.
No root access keys
AWS strongly recommends not creating access keys for the root user, because root can reach everything including billing. Sign in through the console for the few tasks that need root. For everything else, create an administrative user, and prefer IAM roles with temporary credentials over IAM users with long lived keys.
Split the recovery channels
AWS makes a point that is easy to miss: no one person should have access to both the email inbox and the phone number, since both are verification channels for recovering root. Give one group the email and another the phone number. Similarly, consider multi person approval so nobody holds both the root password and the MFA device.
With a three person company, that might mean the CEO holds the phone and the CTO holds the mailbox group.
Watch for root usage
AWS suggests alerting on root sign in and use, using services such as CloudWatch Events, EventBridge with SNS, or GuardDuty if you already run it. The alert should reach more than one person, and the team should know what to do when it fires: confirm it was expected, or escalate as a possible incident.
Root should be rare. An alert that fires twice a year is easy to act on.
Where to store the root password
Do not store the root password in a tool that depends on that same AWS account. If the account is locked, so is the tool. Use a password manager hosted elsewhere, and log who opens that entry.
Checklist.
- Group email on the root user, used for nothing else.
- At least two MFA devices, held by different people.
- No root access keys.
- Different people control the mailbox and the phone number.
- Root sign in alert to a shared channel.
- A written note of what counts as a valid reason to use root.
Quick check
Do we still need root if we use an admin user?
Rarely. AWS keeps a short list of tasks that require root credentials. Everyday work should use the admin user or roles.
Sources
Last reviewed: 19 October 2026.
