How do I delete, deactivate, or rotate root access keys in AWS GovCloud (US) accounts?

Short description

When you sign up for an AWS account, AWS issues you a single sign-in identity called the AWS account root user. The root user can access all AWS services and resources in your account. After you complete the AWS GovCloud (US) sign up process with your root user credentials, AWS also creates the AWS GovCloud (US) account root user.

Note: AWS GovCloud (US) account root user console access isn't supported. You can't sign in to the AWS Management Console for AWS GovCloud (US) with your AWS account email address and password. However, programmatic access is supported through access keys for the root user, which you can use with the AWS CLI or AWS SDK.

Important: It's a best practice to use the AWS account root user only when you create your first AWS Identity and Access Management (IAM) user. After you create that first IAM user, lock away the root user access keys and use them only to perform a few tasks. Use your IAM user account for your day-to-day tasks.

Resolution

Follow these steps to delete, deactivate, or rotate root access keys for your AWS GovCloud (US) account.

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Configure root access keys in the AWS CLI

As your first step, configure the AWS CLI with your AWS GovCloud (US) account root user access keys. You can also use the AWS CLI for local use. For instructions, see Configure AWS GovCloud (US) account root user access keys in the AWS CLI (AWS CloudShell).

Verify that root access keys exist

To verify that your AWS GovCloud (US) account has a root access key, see Does my AWS GovCloud (US) account have existing root access keys?

You can also run the ListAccessKeys AWS CLI command:

aws iam list-access-keys

Delete root access keys

To delete a root access key, see Deleting my AWS GovCloud (US) account root user access keys. You can also use the DeleteAccessKey API with the AWS SDKs.

Deactivate root access keys

To deactivate a root access key, run the AWS CLI command update-access-key similar to the following:

aws iam update-access-key --access-key-id AKIAEXAMPLE123456789 --status Inactive

Note: Replace AKIAEXAMPLE123456789 with your access-key-id value.

Rotate root access keys

To rotate root access keys, follow the instructions to Rotate my AWS GovCloud (US) account root user access keys.

Related information

How IAM differs for AWS GovCloud (US)