# Signing in to AWS GovCloud (US)
The AWS Management Console provides a web-based user interface that you can use to create and manage your AWS resources. For example, you can start and stop Amazon EC2 instances, create Amazon DynamoDB tables, create Amazon S3 buckets, and so on.
Before you can use the AWS Management Console, you must sign in to your AWS GovCloud (US) account. There are two different types of users in AWS GovCloud (US). You are either the account owner (root user) or you are an IAM user. The root user is created when the AWS GovCloud (US) account is created. IAM users are created by the root user or an IAM administrator within the AWS GovCloud (US) account.
If you do not remember your credentials or have trouble signing in using your credentials, see [Troubleshooting AWS GovCloud (US) sign-in or account issues](govcloud-sign-in-issues.md).
## Sign in as the root user
The AWS Management Console for AWS GovCloud (US) only supports signing in as an IAM user. Signing in to the AWS Management Console for AWS GovCloud (US) as the AWS GovCloud (US) account root user or as the associated standard AWS account root user is not supported.
For more information, see [AWS Identity and Access Management in AWS GovCloud (US)](govcloud-iam.md).
For more information about the AWS GovCloud (US) account root user, see [AWS GovCloud (US) account root user](govcloud-account-root-user.md).
## Sign in as an IAM user
Before you sign in to an AWS GovCloud (US) account as an IAM user, be sure that you have the following required information. If you do not have this information, contact the administrator for the AWS GovCloud (US) account.
**Requirements**
+ One of the following:
+ The account alias.
+ The 12-digit AWS GovCloud (US) account ID.
+ The user name for your IAM user.
+ The password for your IAM user.
If you are a root user or IAM administrator and need to provide the AWS GovCloud (US) account ID or AWS GovCloud (US) account alias to an IAM user, see [Your AWS GovCloud (US) account ID and its alias](govcloud-account-ID-alias.md).
If you are an IAM user, you can log in using either a sign-in URL or the main sign-in page.
**To sign in to an AWS GovCloud (US) account as an IAM user using an IAM user sign-in URL**
1. Open a browser and enter the following sign-in URL, replacing account\$1alias\$1or\$1id with the account alias or account ID provided by your administrator.
```
https://.signin.amazonaws-us-gov.com
```
1. Enter your IAM user name and password and choose **Sign in**.
![\[iam-user Sign-in Page\]](http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/images/sign-in-iam-user-capture.png)
**To sign in to an AWS GovCloud (US) account as an IAM user using the main sign-in page**
1. Open [link](https://console.amazonaws-us-gov.com).
If you have signed in previously using this browser, your browser might remember the account alias or account ID for the AWS GovCloud (US) account.
1. Enter account alias or account ID, IAM user name and password and choose **Sign in**.
![\[iam User Sign-in Page\]](http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/images/govcloud-sign-in-1.png)
# Your AWS GovCloud (US) account ID and its alias
To sign in to an AWS GovCloud (US) account as an IAM user, you must have an account alias or an account ID for the AWS GovCloud (US) account. If you are signed in to the AWS Management Console or have configured the AWS CLI or an AWS SDK with your account credentials, you can find the account alias or account ID for the AWS GovCloud (US) account. If you cannot sign in, ask your administrator for the information that you need to sign in.
**Note**
Account aliases are not secrets, and they will appear in your public-facing sign-in page URL. Do not include any sensitive information in your account alias.
## Finding your AWS GovCloud (US) account ID
You can find the account ID for your AWS GovCloud (US) account using the following methods.
**Note**
Support can’t help you recover this information.
### Finding your AWS GovCloud (US) account ID using the AWS Management Console for AWS GovCloud (US)
You can retrieve your AWS GovCloud (US) account ID by [Signing in to AWS GovCloud (US)](signing-into-govcloud.md). In the navigation bar, choose **Support**, and then **Support Center**. Your currently signed-in 12-digit account number (ID) appears in the **Support Center** navigation pane.
### Finding your AWS GovCloud (US) account ID using the standard AWS Management Console
You can retrieve your AWS GovCloud (US) account ID by signing in to [the standard AWS Management Console as the root user](https://docs.aws.amazon.com/signin/latest/userguide/introduction-to-root-user-sign-in-tutorial.html) of the [associated standard AWS account](getting-started-standard-account-linking.md). In the navigation bar, choose your account name on the top right of the window, and then choose **Account**. On the **Account Settings** page, under ** AWS GovCloud (US) **, choose the **Sign up for AWS GovCloud (US) ** button. You will be directed to a page that indicates you already have access and displays your account ID.
### Finding your AWS GovCloud (US) account ID using the AWS CLI
With AWS GovCloud (US) account credentials use the following command to view your user ID, account ID, and your user ARN:
+ [aws sts get-caller-identity](https://docs.aws.amazon.com/cli/latest/reference/organizations/list-create-account-status.html)
If your AWS GovCloud (US) account was created using the [CreateGovCloudAccount](https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateGovCloudAccount.html) API, use the following command view your AWS GovCloud (US) account ID and its associated standard AWS account ID. This call must be made from the standard [AWS Organizations management account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) or by a member account that is a delegated administrator for an AWS service.
+ [aws organizations list-create-account-status](https://docs.aws.amazon.com/cli/latest/reference/organizations/list-create-account-status.html)
### Finding your AWS GovCloud (US) account ID using the API
With AWS GovCloud (US) account credentials, use the following API to view your user ID, account ID, and your user ARN:
+ [GetCallerIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html)
If your AWS GovCloud (US) account was created using the [CreateGovCloudAccount](https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateGovCloudAccount.html) API, use the following command view your AWS GovCloud (US) account ID and its associated standard AWS account ID. This call must be made from the standard [AWS Organizations management account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) or by a member account that is a delegated administrator for an AWS service.
+ [ListCreateAccountStatus](https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListCreateAccountStatus.html)
## Finding your associated standard AWS account ID
**Note**
Support can’t help you recover this information.
### Finding your associated standard AWS account ID using the AWS Management Console for AWS GovCloud (US)
You can retrieve your associated standard AWS account ID by signing into your AWS GovCloud (US) account.
In the navigation bar, choose **Support**, and then **Support Center**. In the **Support Center** navigation pane, choose **Your support cases** and open the most recently created support case by choosing its **Case ID** or **Subject**. In the **Case details**, look for the email address listed in the **Opened by** field. If your account email address has not changed since opening the case, this will be your account email address. [Sign in as the root user](https://docs.aws.amazon.com/signin/latest/userguide/introduction-to-root-user-sign-in-tutorial.html) of your standard AWS account using this email and follow [Finding your AWS account ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html#FindingYourAWSId) in the * AWS Identity and Access Management User Guide*guide.
**Note**
If you have never opened a support case or believe the email address has since changed, [create a support case for account and billing](https://docs.aws.amazon.com/awssupport/latest/user/case-example.html) and [resolve it](https://docs.aws.amazon.com/awssupport/latest/user/monitoring-your-case.html#resolve-a-support-case) immediately. Review the case’s **Open by** field to see the associated account email.
### Finding your associated standard AWS account ID using the AWS CLI
If your AWS GovCloud (US) account was created using [CreateGovCloudAccount](https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateGovCloudAccount.html) API, use the following command view your AWS GovCloud (US) account ID and its associated standard AWS account ID. This call must be made from the standard [AWS Organizations management account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) or by a member account that is a delegated administrator for an AWS service.
+ [aws organizations list-create-account-status](https://docs.aws.amazon.com/cli/latest/reference/organizations/list-create-account-status.html)
### Finding your associated standard AWS account ID using the API
If your AWS GovCloud (US) account was created using the [CreateGovCloudAccount](https://docs.aws.amazon.com/organizations/latest/APIReference/API_CreateGovCloudAccount.html) API, use the following command view your AWS GovCloud (US) account ID and its associated standard AWS account ID. This call must be made from the standard [AWS Organizations management account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) or by a member account that is a delegated administrator for an AWS service.
+ [ListCreateAccountStatus](https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListCreateAccountStatus.html)
## About account aliases
If you want the URL for your sign-in page to contain your company name (or other friendly identifier) instead of your AWS GovCloud (US) account ID, you can create an account alias. This section provides information about AWS account aliases and lists the API operations that you use to create an alias.
Your sign-in page URL has the following format, by default.
```
https://.signin.aws.amazon.com/console/
```
If you create an AWS account alias for your AWS GovCloud (US) ID, your sign-in page URL looks like the following example.
```
https://.signin.aws.amazon.com/console/
```
The original URL containing your AWS GovCloud (US) ID remains active and can be used after you create your AWS account alias.
**Tip**
To create a bookmark for your account sign-in page in your web browser, you should manually type the sign-in URL in the bookmark entry. Don’t use your web browser’s "bookmark this page" feature.
## Creating, deleting, and listing an AWS account alias
You can use the AWS Management Console, the IAM API, or the command line interface to create or delete your AWS GovCloud (US) account alias.
**Considerations**
+ Your AWS GovCloud (US) account can have only one alias. If you create a new alias for your AWS GovCloud (US) account, the new alias overwrites the previous alias, and the URL containing the previous alias stops working.
+ The account alias must be unique across all Amazon Web Services products. It must contain only digits, lowercase letters, and hyphens. For more information on limitations on AWS account entities, see [IAM and AWS STS quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html).
+ Changes to your AWS GovCloud (US) account alias or the associated standard AWS account alias will not overwrite the other alias. They can each be customized without interference of the other. See [Creating](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html#CreateAccountAlias) in the * AWS Identity and Access Management User Guide*to learn more about customizing the associated standard AWS account alias.
### Creating, editing, and deleting aliases (console)
You can create, edit, and delete an account alias from the AWS Management Console for AWS GovCloud (US).
**To create, edit, or remove an account alias (console)**
1. Sign in to the AWS Management Console for AWS GovCloud (US) and open the IAM console at https://console.amazonaws-us-gov.com/iam/.
1. In the navigation pane, choose **Dashboard**.
1. In the ** AWS account ** section, find **Account Alias**, and choose **Create**. If an alias already exists, then choose **Edit**.
1. Type the name you want to use for your alias, then choose **Save changes**.
1. To remove the alias, next to **Account Alias** choose **Delete**, and then choose **Delete**. The sign-in URL reverts to using your AWS account ID.
### Creating, deleting, and listing aliases (AWS CLI)
**Note**
You must use AWS GovCloud (US) credentials.
To create an alias for your AWS Management Console for AWS GovCloud (US) sign-in page URL, run the following command:
+ [aws iam create-account-alias](https://docs.aws.amazon.com/cli/latest/reference/iam/create-account-alias.html)
To delete an AWS account ID alias, run the following command:
+ [aws iam delete-account-alias](https://docs.aws.amazon.com/cli/latest/reference/iam/delete-account-alias.html)
To display your AWS account ID alias, run the following command:
+ [aws iam list-account-aliases](https://docs.aws.amazon.com/cli/latest/reference/iam/list-account-aliases.html)
### Creating, deleting, and listing aliases (AWS API)
**Note**
You must use AWS GovCloud (US) credentials.
To create an alias for your AWS Management Console for AWS GovCloud (US) sign-in page URL, call the following operation:
+ [aws CreateAccountAlias](https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateAccountAlias.html)
To delete an alias for your AWS Management Console for AWS GovCloud (US) sign-in page URL, call the following operation:
+ [aws DeleteAccountAlias](https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteAccountAlias.html)
To display your AWS account ID alias, call the following operation:
+ [aws ListAccountAliases](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAccountAliases.html)
# Troubleshooting AWS GovCloud (US) sign-in or account issues
Use the information here to help you troubleshoot sign-in and other AWS GovCloud (US) account issues. For step-by-step directions to sign in to an AWS account, see [Sign in as the root user](signing-into-govcloud.md#sign-in-root-user-govcloud)
If you are having trouble signing in to your [associated standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html), see [Troubleshooting sign-in issues](https://docs.aws.amazon.com/signin/latest/userguide/troubleshooting-sign-in-issues.html) in the * AWS Sign-In User Guide* instead.
**Note**
For security purposes, AWS doesn’t have access to view, provide, or change your credentials.
## My AWS GovCloud (US) credentials aren’t working
When you can’t sign in to the AWS Management Console for AWS GovCloud (US), try to remember how you previously accessed AWS.
**If you don’t remember signing in using a password at all**
You might have previously accessed AWS without using AWS credentials. This is common for enterprise single sign-on through IAM Identity Center. Accessing AWS this way means that you use your corporate credentials to access AWS accounts or applications without entering your credentials.
+ ** AWS access portal** – If an administrator allows you to use credentials from outside AWS to access AWS, you need the URL for your portal. Check your email, browser favorites, or browser history for a URL that includes `awsapps.com/start` or `signin.aws/platform/login`.
For example, your custom URL might include an ID or a domain such as `https://d-1234567890.awsapps.com/start`.
If you can’t find your portal link, contact your administrator. Support can’t help you recover this information.
**If you remember signing in using a password**
You might be on the wrong page. Try signing in on a different page:
+ ** Root user sign-in page** – Signing in to the AWS Management Console for AWS GovCloud (US) as the root user is not supported. To learn more about the root user in AWS GovCloud (US), see [AWS GovCloud (US) account root user](govcloud-account-root-user.md) in the * AWS GovCloud (US) User Guide*.
+ ** IAM user sign-in page** – If you or someone else created an IAM user within a single AWS GovCloud (US) account, you must know that account ID or alias. Enter your account ID or alias, user name, and password in to the [AWS Management Console for AWS GovCloud (US)](https://console.aws.amazon.com/). To learn how to access the IAM user sign-in page, see [Sign in as the root user](signing-into-govcloud.md#sign-in-root-user-govcloud). If you forgot your IAM user password, see [I lost or forgot my AWS GovCloud (US)IAM user name or password](#troubleshoot-lost-iam-password) for information on resetting your IAM user password. If you forgot your account number, search your email, browser favorites, or browser history for a URL that includes `signin.amazonaws-us-gov.com/`. Your account ID or alias will precede this URL, such as ` account_alias_or_id.signin.amazonaws-us-gov.com`. The account ID can also follow the `account=` or `account%3D` text in the URL. If you can’t find your account ID or alias, see [I need my AWS GovCloud (US) account ID or account alias](#troubleshoot-need-account-id-alias).
+ ** AWS access portal** – If an administrator set up an AWS IAM Identity Center identity source for AWS, you must sign in using your user name and password. In this case, you need the URL for your portal. Check your email, secure password storage, browser favorites, or browser history for a URL that includes `start.us-gov-home.awsapps.com` or `s signin-fips.amazonaws-us-gov.com/platform/login`. For example, your custom URL might include an ID or a domain such as `https://start.us-gov-home.awsapps.com/directory/d-1234567890`.
If you can’t find your portal link, contact your administrator. Support can’t help you recover this information.
For more assistance on troubleshooting your sign-in issues, see [What do I do if I’m having trouble signing in to or accessing my AWS account?](https://aws.amazon.com/premiumsupport/knowledge-center/sign-in-account/)
## I need my AWS GovCloud (US) account ID or account alias
If you are an IAM user and you are not signed in, you must ask your administrator for the AWS account ID or AWS account alias. You need this information, plus your IAM user name and password, to sign in to an AWS account. To learn more about where to find your account ID and alias, see [Your AWS GovCloud (US) account ID and its alias](govcloud-account-ID-alias.md) in the * AWS GovCloud (US) User Guide*.
**Note**
Support can’t help you recover this information.
## I lost or forgot my AWS GovCloud (US) IAM user name or password
If you are an IAM user, your administrator provides your credentials. If you forget your password, you must ask your administrator to reset your password. To learn how an administrator can manage your password, see [Managing passwords for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_admin-change-user.html).
If you are an administrator of the AWS GovCloud (US) account and have forgot your password to the AWS Management Console for AWS GovCloud (US), please contact another administrator in the account to assist with restoring your access. If there are no other users with administrative access to your account, you will need root credentials for your AWS GovCloud (US) account to restore console access. To learn how to restore administrative console access with the root user, see [AWS GovCloud (US) account root user](govcloud-account-root-user.md) in the * AWS GovCloud (US) User Guide*.
## I lost or forgot the access keys for my AWS GovCloud (US) IAM user name
If you are an IAM user and you forget your access keys, you will need new access keys. If you have permission to create your own access keys, you can find instructions for creating a new one at [Managing access keys (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey). If you do not have the required permissions, you must ask your administrator to create new access keys. If you are still using your old keys, ask your administrator not to delete the old keys. To learn how an administrator can manage your access keys, see [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html).
You should follow the AWS [best practice](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials) of periodically changing your password and AWS access keys. In AWS, you change access keys by rotating them. This means that you create a new one, configure your applications to use the new key, and then delete the old one. You are allowed to have two access key pairs active at the same time for just this reason. For more information, see [Rotating access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_RotateAccessKey).
## I lost or forgot the access keys for my AWS GovCloud (US) root user
If you forget your AWS GovCloud (US) account root access keys, you can request new access keys, see [AWS GovCloud (US) account root user](govcloud-account-root-user.md) in the * AWS GovCloud (US) User Guide*.
## I forgot the root user password for my standard AWS account
If you are a root user and you have lost or forgot the password for your [associated standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html), you can reset your password. You must know the email address used to create the associated standard AWS account and you must have access to the email account. For more information, see [Resetting lost or forgotten passwords or access keys for AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys_retrieve.html).
## I don’t know the email for my standard AWS account or AWS GovCloud (US) account
Your AWS GovCloud (US) account email address is the same as email address configured in its [assocated standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html). Changing the standard AWS account email will result in a change to the AWS GovCloud (US)) account email.
If you are not sure of the email address associated with your AWS GovCloud (US) account, [sign in to your AWS GovCloud (US) account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/sign-in-iam-govcloud.html). In the navigation bar, choose **Support**, and then **Support Center**. In the **Support Center** navigation pane, choose **Your support cases** and open the most recently created support case by choosing its **Case ID** or **Subject**. In the **Case details**, look for the email address listed in the **Opened by** field. If your account email address has not changed since opening the case, this will be your account email address.
**Note**
If you have never opened a support case or believe the email address has since changed, [Create a support case for account and billing](https://docs.aws.amazon.com/awssupport/latest/user/case-example.html) and [resolve it](https://docs.aws.amazon.com/awssupport/latest/user/monitoring-your-case.html#resolve-a-support-case) immediately. Review this cases **Open by** field to see the associated account email.
If you can’t sign in to your AWS GovCloud (US) account to find your email address, see [I don’t have access to the email for my AWS account](https://docs.aws.amazon.com/signin/latest/userguide/troubleshooting-sign-in-issues.html#troubleshoot-lost-email) in the AWS Sign-In User Guide.
## I don’t have access to the email for my standard AWS account or AWS GovCloud (US) account
If you know the email address, but no longer have access to the email, see [I don’t have access to the email for my AWS account](https://docs.aws.amazon.com/signin/latest/userguide/troubleshooting-sign-in-issues.html#troubleshoot-lost-email) in the * AWS Sign-In User Guide*.
## I need to change the credit card for my AWS GovCloud (US) account
To change the credit card for your AWS GovCloud (US) account, you must have access to its [associated standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html). See [I need to change the credit card for my AWS account](https://docs.aws.amazon.com/accounts/latest/reference/troubleshooting_other.html#troubleshoot-change-credit-card) in the * AWS Account Management Reference Guide*.
## I need to report fraudulent AWS GovCloud (US) account activity
If you suspect fraudulent activity using your AWS GovCloud (US) account and would like to make a report, see [How do I report abuse of AWS resources](https://aws.amazon.com/premiumsupport/knowledge-center/report-aws-abuse/).
## I need to close my AWS GovCloud (US) account activity
See [Closing an AWS GovCloud (US) account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/Closing-govcloud-account.html) in the *AWS GovCloud (US) User Guide*.
# AWS GovCloud (US) account root user
When you first create a standard AWS account (not an AWS GovCloud (US) account), you begin with one identity that has complete access to all AWS services and resources in the account. This identity is called the AWS account root user. You can sign in as the root user using the email address and password that you used to create the account.
When you finish the [AWS GovCloud (US) Sign Up](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-sign-up.html) process and your AWS GovCloud (US) account is created, the AWS GovCloud (US) account root user is also created at that time. Unlike the conclusion of the standard AWS account sign up process, you cannot sign-in to the AWS Management Console for AWS GovCloud (US) using your account email address and password. Depending on the method you used to sign up, you are provided initial console access to your AWS GovCloud (US) account via either an Administrator IAM user or the `OrganizationAccountAccessRole` IAM role.
While AWS GovCloud (US) account root user console access is not supported, programmatic access keys are supported. Access keys are long-term credentials for an IAM user or the AWS account root user. You can use access keys to sign programmatic requests to the AWS CLI or AWS API (directly or using the AWS SDK).
Anyone who has root user access keys for your AWS GovCloud (US) account has unrestricted access to all the resources in your account.
In this guide you will find…
+ How to identify if your AWS GovCloud (US) account has root access keys
+ Step-by-step directions to request your AWS GovCloud (US) account root user access keys
+ Information that will help you complete task that require the AWS GovCloud (US) account root user
**Important**
We strongly recommend that you do not use the root user for your everyday tasks, even the administrative ones. Instead, adhere to the best practice of using the root user only to create your first IAM user. Then securely lock away the root user access keys and use them to perform only a few account and service management tasks. To view the tasks that require root user access keys, see [Tasks in AWS GovCloud (US) Regions that require root user access keys](#govcloud-tasks-require-root-user)
## Does my AWS GovCloud (US) account have existing root access keys?
As an AWS GovCloud (US) account administrator, you may want to know if there are root access keys in your AWS GovCloud (US) account.
### Method 1
You can generate and download a credential report that lists all users in your account and the status of their various credentials, including passwords, access keys, and MFA device from your AWS GovCloud (US) account.
To get your credential report, see [Getting credential reports for your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html) in the * AWS Identity and Access Management User Guide*.
In the credential report CSV, the following columns will allow you to identify if you have root access keys in your account and if they are active.
+ **user** – Identify the `root_account` row.
+ **access\$1key\$11\$1active** – When the root user has an access key and the access key’s status is Active, this value is `TRUE`. Otherwise it is `FALSE`.
+ **access\$1key\$11\$1last\$1rotated** – The date and time, in [ISO 8601 date-time format](https://en.wikipedia.org/wiki/ISO_8601), when the root user's access key was created or last changed. If the root user does not have an active access key, the value in this field is `N/A` (not applicable).
+ **access\$1key\$12\$1active** – When the root user has a second access key and the second key’s status is Active, this value is `TRUE`. Otherwise it is `FALSE`.
+ **access\$1key\$12\$1last\$1rotated** – The date and time, [ISO 8601 date-time format](https://en.wikipedia.org/wiki/ISO_8601), when the root user's second access key was created or last changed. If the root user does not have a second active access key, the value in this field is `N/A` (not applicable).
In this example, the root user has an active root access key in the account because the `access_key_1_last_rotated` field is not marked `N/A` and the `access_key_1_active` field is marked `TRUE`. You can also see there is not a second access key associated with the root user because `access_key_2_last_rotated` field is marked `N/A`. Since there is not a second access key `access_key_2_active` field is marked `FALSE`.
![\[In this example, the root has an active root access key in the account with no second access key.\]](http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/images/govcloud-root-user-cred-report.png)
For info on removing root user access keys, see [Deleting my AWS GovCloud (US) account root user access keys](#delete-govcloud-root-access-key).
### Method 2
If AWS Security Hub CSPM is enabled on your account, the following Security Hub CSPM controls have a Failed compliance status when root access keys exist in your AWS GovCloud (US) account.
+ [CIS AWS Foundations Benchmark standard: 1.12 – Ensure no root user access key exists](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html#securityhub-cis-controls-1.12)
+ [Payment Card Industry Data Security Standard (PCI DSS): [PCI.IAM.1 IAMroot user access key should not exist](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-pci-controls.html#pcidss-iam-1)]
+ [AWS Foundational Security Best Practices standard: [IAM.4 IAMroot user access key should not exist](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-iam-4)]
For more information on AWS Security Hub CSPM, see the [AWS Security Hub CSPM User Guide](https://docs.aws.amazon.com/securityhub/latest/userguide/index.html).
To remediate these findings, see [Deleting my AWS GovCloud (US) account root user access keys](#delete-govcloud-root-access-key).
## Requesting root access keys for an AWS GovCloud (US) account
AWS GovCloud (US) account root user access keys can be requested from Support. Once your request is processed and approved, any existing AWS GovCloud (US) account root user access keys in your AWS GovCloud (US) account will be deleted, followed by the creation of a single new access key. This new access key will stored as an encrypted secret with AWS Secrets Manager and AWS KMS in the **US East (N. Virginia)** Region. This secret is made available exclusively to the root user of the [standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html) associated with your AWS GovCloud (US) account.
AWS managed account for this process: **536883072436**.
Use the following guide to request and retrieve a new AWS GovCloud (US) account root user access key.
**Important**
This process is for AWS GovCloud (US) customers who have already signed up for an AWS GovCloud (US) account and completed all onboarding steps. If you are having issues with onboarding into AWS GovCloud (US), see [AWS GovCloud (US) Sign Up](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-sign-up.html) or [contact Support](https://console.aws.amazon.com/support/home#/case/create?issueType=customer-service&serviceCode=customer-account&categoryCode=aws-govcloud-us-onboarding).
### Prerequisites
This task **requires root access** to the [standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html) associated with your AWS GovCloud (US) account.
**Important**
The AWS GovCloud (US) account root user access keys provides unrestricted access to your AWS GovCloud (US) account. For security purposes Support will only process request for AWS GovCloud (US) root credentials when the requester is the root user of the [standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html) associated with your AWS GovCloud (US) account.
If your AWS GovCloud (US) account is in an AWS GovCloud (US) Organization and has a service control policy (SCP) applied to the AWS GovCloud (US) account that [disallows actions as the root user](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#disallow-root-auser-actions) or [prevents the creation of root access keys](https://docs.aws.amazon.com/controltower/latest/userguide/strongly-recommended-controls.html#disallow-root-access-keys), your AWS GovCloud (US) [Organization management account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) will need to adjust the SCP before you can request AWS GovCloud (US) account root access keys. Specifically they will need to allow the following actions from the root user:
+ [CreateAccessKey](https://console.aws.amazon.com/cloudtrail/home?region=us-gov-west-1#/events/0b68c53f-66cf-4b01-a0c5-c4012b0877e2)
+ [DeleteAccessKey](https://console.aws.amazon.com/cloudtrail/home?region=us-gov-west-1#/events/dc0b9902-6938-4750-99e5-b80b3052a41d)
+ [ListAccessKeys](https://console.aws.amazon.com/cloudtrail/home?region=us-gov-west-1#/events/bbeea4d0-f041-4d0c-969d-d59c7ef2aa19)
### For AWS GovCloud (US) Organization Management Account Administrators
The following SCP meets the minimum requirements to process a request for AWS GovCloud (US) account root user access keys while disallowing all other actions from the AWS GovCloud (US) account root user.
This is useful in the situation where a member account may have forgot or lost their existing AWS GovCloud (US) account root user access keys and you would like to prevent them from being used to take actions against account resources until Support can process your request for new AWS GovCloud (US) account root user access keys.
**Note**
When a member account needs to perform administrative task as the root user after retrieving their new AWS GovCloud (US) account root access keys from Support, they may be blocked from completing the task. Move the member account to another OU with a less restrictive SCP applied or remove the policy completely to enable them to complete [Tasks in AWS GovCloud (US) Regions that require root user access keys](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-account-root-user.html).
This SCP will not affect the AWS GovCloud (US) Organizations Management account should you move that account into an OU with this SCP applied. To learn more, see [Tasks and entities not restricted by SCPs](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html#not-restricted-by-scp) in the * AWS Organizations User Guide*.
**Step 1: Gather required information**
Gather the following required information so you have it on hand when you open a support case in Step 2:
1. **Company Name** – This is the full legal name of a Company or Public Sector Organization associated with this account. If this AWS GovCloud (US) account is not associated with a Company or Public Sector Organization, provide Individual Account Owner as the Company Name.
1. **Account Email** – If you are not aware of your account email, see [I don’t know the email for my standard AWS account or AWS GovCloud (US) account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-troubleshooting.html#troubleshoot-forgot-email-account) in the * AWS GovCloud (US) User Guide*. If you need to change your account email, see [How do I change the email address that’s associated with my AWS account?](https://aws.amazon.com/premiumsupport/knowledge-center/change-email-address/)
1. **Address** – This is the mailing address for your Company, Public Sector Organization, or the Individual Account Holder.
1. ** AWS GovCloud (US) Account ID** – If you are not aware of your AWS GovCloud (US) account ID, see [Finding your AWS GovCloud (US) account ID](govcloud-sign-in-issues.md#troubleshoot-need-account-id-alias) in the * AWS GovCloud (US) User Guide*.
1. **Asymmetric KMS key ** – You need to provide an asymmetric KMS key when requesting root access keys for an AWS GovCloud (US) account. Generate the key in the standard AWS account associated with the AWS GovCloud (US) account and in `us-east-1`.
To generate a KMS key, use the following AWS CLI command:
```
aws kms create-key \
--region us-east-1 \
--key-usage ENCRYPT_DECRYPT \
--key-spec RSA_2048 \
--description "Asymmetric KMS key for encryption and decryption" \
--policy '{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam:::root"},
"Action": "kms:*",
"Resource": "*"
},
{
"Sid": "Allow external account to encrypt",
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam::536883072436:root"},
"Action": "kms:Encrypt",
"Resource": "*"
}
]
}'
```
1. **Account Owner** – This is the full legal name (First, Middle, Last Name) of the account owner who is requesting AWS GovCloud (US) account root user access keys. Account owner is the individual creating the support case that meets the requirements outlined in the template found in Step 2.
**Step 2: Create a support case**
In this step, you create a support case to the Accounts and Billing support team to request root credentials for your AWS GovCloud (US) account.
1. [Sign in to your standard AWS account](https://console.aws.amazon.com/) associated with your AWS GovCloud (US) account as the root user. To learn about signing in as the root user, see [Sign in as the root user](https://docs.aws.amazon.com/signin/latest/userguide/introduction-to-root-user-sign-in-tutorial.html) in the * AWS Sign-In User Guide*.
If you are having issues signing in to your standard AWS account as the root user, see [Troubleshooting AWS sign-in or account issues](https://docs.aws.amazon.com/signin/latest/userguide/troubleshooting-sign-in-issues.html) in the * AWS Sign-In User Guide*.
1. Navigate to [Support Center](https://console.aws.amazon.com/support/home#/case/create?issueType=customer-service&serviceCode=customer-account&categoryCode=aws-govcloud-us-request-root-credentials) by choosing the **?** icon in the navigation bar and then choose **Support Center** from the dropdown.
1. Choose **Create case** from the Open support cases section.
1. Choose **Account and billing**.
1. Use the dropdown box to choose **Account**. For **Category** choose ** AWS GovCloud (US) – Request Root Credentials**, and then choose **Next step: Additional information**.
1. For **Subject** enter ** AWS GovCloud (US) – Request Root Credentials**.
1. In the **Description** box, copy and paste the following template:
```
Company Name: [Company Name From Step 1]
Account Email: [Account Email From Step 1]
Address: [Address From Step 1]
{govcloud-us} Account ID: [{govcloud-us} Account ID From Step 1]
Asymmetric {kms-key} ARN: [Asymmetric {kms-key} ARN from Step 1]
I [Full Legal Name: First, Middle, Last Name of the Account Owner] hereby
acknowledge the applicable requirements contained in the {govcloud-us}
Addendum to the {aws} Customer Agreement (the "{govcloud-us} Addendum")
that apply to and governs the use of the {aws-services} in the {govcloud-us}
Region by the above referenced company. In accordance with the terms of the
{govcloud-us} Addendum, I represent and warrant that: I am a U.S. person;
not subject to export restrictions under U.S. export control laws and regulations
(e.g., I am not on the denied or debarred party list or otherwise subject
to sanctions); and have full authority to request {aws} release to me
account credentials relating to the subject {govcloud-us} account listed above.
By typing my name below, I certify the above statements to be true and correct
to the best of my knowledge, and that this information can be used for the
purpose of processing new root credentials for the {govcloud-us}
account listed above.
Name: [Full Legal Name: First, Middle, Last Name of the Account Owner]
Title: [Your title related to the Company Name identified above]
Date: [Enter the date]
```
1. Using the information collected in Step 1 fill out the required fields indicated by [brackets] in the template.
**Important**
Support will not process your request should the following be identified in your support case:
An incomplete template was provided.
There is missing information in the required fields.
The AWS GovCloud (US) Account ID field has an AWS GovCloud (US) account ID not associated with the [standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html) that is creating this support case.
The Account Email field has an email that is not associated with the standard AWS account that creates this support case.
Multiple AWS GovCloud (US) account IDs were provided. Each AWS GovCloud (US) account requested will need its own support case from the associated [standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html) as the root user.
The following image shows an example of a completed ticket:
![\[Example of complete support case.\]](http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/images/root_user_support_case_example.png)
1. Choose **Next step**.
1. Choose **Contact us**, choose your **Preferred contact language**, and then choose **Web** as the contact method, if it’s not selected by default.
![\[Web via email and Support Center contact method selected.\]](http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/images/contact_options_support.png)
1. Choose **Submit**.
1. Support will work with our internal service teams on your request and follow up with any additional questions.
Once approved and processed, Support will follow-up on the support case to provide the required information you need to continue onto Step 3.
**Step 3: Retrieving your AWS GovCloud (US) account root user access keys**
In this step, you will retrieve your new AWS GovCloud (US) account root user access keys.
1. [Sign in to your standard AWS account](https://console.aws.amazon.com/) associated with your AWS GovCloud (US) account as the root user. To learn about signing in as the root user, see [Sign in as the root user](https://docs.aws.amazon.com/signin/latest/userguide/introduction-to-root-user-sign-in-tutorial.html) in the * AWS Sign-In User Guide*.
If you are having issues signing in to your [standard AWS account](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/getting-started-standard-account-linking.html) as the root user, see [Troubleshooting AWS sign-in or account issues](https://docs.aws.amazon.com/signin/latest/userguide/troubleshooting-sign-in-issues.html) in the * AWS Sign-In User Guide*.
1. Navigate to [Support Center](https://support.console.aws.amazon.com/support/home#/case/history) by choosing the **?** icon in the navigation bar and then choose **Support Center** from the dropdown.
1. In the **Support Center** navigation pane, choose **Your support cases**.
1. Open your support case created in Step 2 by choosing the **Case ID** or **Subject**.
1. Find the latest **Correspondence** from Support.
1. Use keyboard shortcuts or context (right-click) menu to copy the AWS CLI command provided by Support, which looks like this:
```
aws secretsmanager get-secret-value \
--secret-id '' \
--region 'us-east-1' \
--version-stage 'AWSCURRENT' \
--output 'text' \
--query <'SecretString'> \
--no-cli-pager
```
Then decrypt the output of `get-secret-value` for the credentials using this AWS CLI command:
```
aws kms decrypt \
--key-id '' \
--region 'us-east-1' \
--encryption-algorithm RSAES_OAEP_SHA_256 \
--ciphertext-blob '