[trelliscoded]

I try not to handle my root account credentials. Everything on the list that requires root account access is pretty scary:

https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.ht...

At one place, they gave them to outside counsel, and at another place they're in a safe that only the trusted company ops person has access to, and she isn't remote.

Generally, you should be breaking your footprint into different AWS accounts under an org with SCPs if you really need root account access for something, not sharing the credentials for the main account.

[gfisher]

I hadn't considered outside council. That's a good idea. The issue with everybody being remote is that our corporate safe is difficult to get into (we are on a two-key system), but an outside entity is worth looking into.