Rubygems.org AWS Root Access Event – September 2025

Re:Rubygems.org AWS Root Access Event – September 2025 by frenchtoast8 on Thursday October 09, 2025 @04:18PM (#45532571)

I believe this is a scenario where AWS recommends multiple accounts.

1. Create another "management" AWS account, and make your other AWS account a child to that.

2. Ensure no one ever logs in to the "management" account, as there shouldn't be any business purpose in doing so. For example, you should require a hardware key to log in.

3. Configure the "management" account to force children account to enable AWS Config, AWS CloudTrail, etc. Also force them to duplicate logs to the "management" account.

Step 2 is important. At the end of the day, an organization can always find a way to render their security measures useless.

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by 0cf8612b2e1e on Thursday October 09, 2025 @04:46PM (#45532886)

2) Surely, someone needs access to the account. How do you prevent those with access from using it? Security feels like turtles all the way down where you ultimately have to trust a few people to do the right thing.

[ Parent | on HN ]

Re:Rubygems.org AWS Root Access Event – September 2025 by zrail on Thursday October 09, 2025 @06:33PM (#45533746)

The only reason someone would need access to the management account would be maintaining child accounts and IAM roles or reviewing logs, none of which should need root.

[ Parent | on HN ]