When we onboard existing AWS accounts into the main Cornell AWS Organization, we need administrator-level access to the account in order to implement our Standard AWS Account Configurations. These instructions shown how to accomplish that.


Option 1 - (Preferred) Provide root user credentials

The root user of your AWS account is the main email address you used when you created the account.

  1. Login to the AWS web console for your AWS account using the root user (i.e., root email address and associated password). This tests to ensure that those credentials are still valid.

  2. If you had to use MFA  when you logged in, then you need to remove MFA for that root user so that Cloud Team folks can use the root credentials without having the MFA key. 
    1. If MFA is set for the root user, follow the instructions labeled "To deactivate the MFA device for your AWS account root user (console)" on this page https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_disable.html

  3. You have two options to send the root user credentials to the Cloud Team:
    1. Via Cornell Dropbox:
      1. Create a plain text file containing the root email address and password.
      2. Login to https://dropbox.cornell.edu/ and send the file to the Cloud Team staff person you are working with. If unsure, send it to pea1@cornell.edu. Instructions for using Cornell Dropbox are here: https://it.cornell.edu/tags/cornell-dropbox
    2. Via LastPass:
      1. Create a LastPass folder and share it with the Cloud Team staff person you are working with. If unsure, share it with pea1@cornell.edu.
      2. Add the LastPass record (site or note) containing the root credentials for the AWS account into the shared folder.

Option 2 - Create a new IAM user

With this option, you create a new AWS IAM user and provide those credentials to provide access to your account for the Cloud Team.

  1. Login to the AWS web console for your AWS Account.

  2. Use these instructions to create a new user: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html#id_users_create_console
    1. Use "cloudteam" as the username.
    2. Be sure to allow "AWS Management Console access"
    3. Choose "Attach existing policies to user directly" and attach "AdministratorAccess" to the new user.
    4. Be sure to save the password set for the new user.

  3. You have two options to send the IAM user credentials to the Cloud Team:
    1. Via Cornell Dropbox:
      1. Create a plain text file containing the IAM user name and password.
      2. Login to https://dropbox.cornell.edu/ and send the file to the Cloud Team staff person you are working with. If unsure, send it to pea1@cornell.edu. Instructions for using Cornell Dropbox are here: https://it.cornell.edu/tags/cornell-dropbox
    2. Via LastPass:
      1. Create a LastPass folder and share it with the Cloud Team staff person you are working with. If unsure, share it with pea1@cornell.edu.
      2. Add the LastPass record (site or note) containing the IAM user credentials for the AWS account into the shared folder.
  • No labels