There is a very large project to fix this. But as you can probably imagine, with a system this large and complex making changes to fundamentals like identities is hard, and done with a lot of care.
All new accounts created today are "decoupled". They are not your Amazon account, and (barring some special internal tools for testing) you cannot make them the same account. But migrating all the existing accounts without causing harm is a messy business.
My own AWS account has the same problem.
Generically: Identity is a very hard space. It's one of those things that sounds really simple but the deeper you go the more edge cases you find.
With an complex systems, changing fundamental designs of the system- while users and other systems are currently using that system- is like trying to upgrade the engines on a plane while in flight. Technically possible, with a lot of planning, but any wrong move or bad assumption and you're going to crash.
I can say for certain that no, it is not something taken seriously.
I (loudly) complained to AWS enterprise support in 2017, 4 years ago, about this issue. Got escalated as high as could possibly be escalated (team leads of IAM calling my cell phone).
4 years later and the issue is unresolved. This is Amazon we’re talking about. There’s very little that can’t be fixed in 4 years.
Clearly the solution to this is for the retail site to support IAM roles.
This bite me hard last year... I lost my phone and with it my MFA for the root account, and of course forgot to properly backup the MFA seed.
Now when calling AWS support to get back my accesses, they ask me to prove ownership of my Amazon.com account with the same email... Which is like 15 years old. I changed phone number, address, country dozens of times since then.
Apparently I would have to get back to my home country and ask a notary to sign a paper asserting I am really me to get back my accesses. Nightmare.
My current setup is two yubikeys (one in storage, one in my computer) and OTP on my phone. Failure is still possible but it’s unlikely enough for me.
> If your AWS account and Amazon.com retail account share the same login information, updating the email address or password on one of the accounts changes information on the other account.
[0]: https://aws.amazon.com/premiumsupport/knowledge-center/trans...
At least when I dealt with this mess a couple years ago, AWS support did not have reassuring answers. They claimed they could separate it, but if something went wrong we were on our own without spending large amounts of money on premium support.
Lucky for me most of our resources were already in child AWS accounts and the rest could be migrated, so I was able to create a _new_ top-level AWS account, re-parent the child accounts, and delete the old parent account instead. At least with that process we could create a throwaway child account and test every step before doing it for real with production.
My account is very old. From the sounds of it, my grievance has been addressed by Amazon but I'm grandfathered on the old system.
Perhaps it's because my account is very old - possibly having been created near the inception of AWS. I have no memory of creating the account.
I thought my personal account was this old already, clearly not.
What I do despise is that my Amazon.com credentials are the same as my Amazon AWS root account credentials. They aren't equals. The services share the name of a rainforest and a very rich CEO but that's about where the similarities end for my part.
I'd rather not have to plug in my AWS root account credentials when I get the urge to impulse buy a robotic vacuum cleaner.