[gfisher]

Yes, you are totally correct. We don't use our root account now, and we keep our our corporate Yubikeys in a safe with a 2-key access lock. The issue is that fewer and fewer people have access to the safe due to geography. I'm worried about our in-city bus factor.

[GauntletWizard]

Tread carefully with permissions; when making changes to admin roles make sure you've got a backup role you can use to undo.

Remember that if all else fails, AWS will send your company a physical letter that support will verify and unlock your account.