Is there a smart solution for multi factor authentication that can be shared between people who are remote?
You should be using IAM user accounts for everything else. Unprivileged base users with access to two different roles. One for general use, one that has administrator access. Build a lambda that sends a daily e-mail summarizing logins to the second and actions those logins took to your security team. You only need to be quite this complex as your corporation grows, and you probably should only ever have a (under twenty) list of people with access to that second role.
The other key to this puzzle is separate AWS Root Accounts for different use cases; Run your Dev in one and give out the administrative role willy-nilly, "Prod" in another that's tightly locked down. AWS SSO is one good solution to managing all these accounts (there are others). Run your "Prod Data but not visible to customers" in another if you must have it (I suggest investing in automation instead - Set up a service team to handle understanding requests for "Prod" data, that will run queries in prod after vetting them and anonymizing, but don't ever load that data into staging; Have them also help engineers sufficiently fake that data).
Remember that if all else fails, AWS will send your company a physical letter that support will verify and unlock your account.
- the root account should not be used. Disable it from being able to do anything with an SCP
- new accounts created with aws organisations by default have a random password and no mfa. Access is granted by going through the password reset process. Switch to this process for existing accounts, randomise all the passwords, grant break glass access via password resetting (ensure your contact details are valid). The password reset typically requires access to the email account (make it accessible via SSO) and potentially a phone call, ensure a virtual phone number is used and root holders can point it at their phone.
- use the likes of azure ad, keycloak or okta to store your organisations identities. Require MFA on them via yubikey. Enable access to multiple aws accounts via aws sso.
- for ssh access switch to using aws ssm.
https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.ht...
At one place, they gave them to outside counsel, and at another place they're in a safe that only the trusted company ops person has access to, and she isn't remote.
Generally, you should be breaking your footprint into different AWS accounts under an org with SCPs if you really need root account access for something, not sharing the credentials for the main account.
If he gets hit by a bus we know enough to recover everything.
