AWS Completes MFA Enforcement for Root Users Across All Account Types
Summary
AWS says it completed MFA enforcement for root users across all account types in June 2025. The post supports ASD’s MFA campaign and urges enabling MFA on email, collaboration, source control and other accounts.
Key points
- AWS says MFA enforcement for root users across all account types was completed in June 2025, following phased changes that began in May 2024.
- AWS describes the milestone as the first of its kind among major cloud providers.
- AWS says MFA is available to customers at no additional cost and supports FIDO2 passkeys and FIDO-certified security keys.
- The post urges enabling MFA on email, collaboration tools, source control and other services, as compromised accounts can expose AWS access or infrastructure-as-code secrets.
- AWS says teams can configure MFA for IAM users through the AWS Management Console.
Article Details
- Event Type
- AWS security milestone: AWS completed MFA enforcement for root users across all account types in June 2025, supporting ASD’s MFA campaign.
- Impact
- AWS states that MFA is enforced automatically for root users across all account types and is available to customers at no additional cost. AWS says MFA prevents over 99 percent of password-related attacks; this is an AWS-reported claim.
Vendors
Products
AWS Identity and Access ManagementIn June 2025, AWS Identity and Access Management (IAM) achieved comprehensive MFA enforcement for root users across all account types, a significant milestone and the first of its kind among major cloud providers.AWS OrganizationsThis was the culmination of a deliberate, phased security journey: beginning with requiring MFA for AWS Organizations management account root users in May 2024, expanding to standalone account root users in June 2024,