how I fucked up my MFA, lost my AWS root account :(

2025/11/08
awscloudmfa

tldr: the backup password was a password I use for everything. Just never tried it.

  1. New phone, Authy locked, AWS root gone
  2. AWS recovery: email worked, phone call never came
  3. Help docs useless, support requires login, login requires MFA
  4. CLI hack: created IAM user with full permissions, logged into console
  5. "Only the root user can manage root credentials." Button greyed out
  6. New AWS account just to file a support case
  7. Support agents not on MFA team, got into an argument
  8. MFA team called brother's phone while he was driving, nobody understood
  9. International calling was off the whole time
  10. Enabled it, got the OTP, account unlocked
  11. Went back to Authy, typed a common password. It worked. The tokens were never lost. Just forgot the unlock password

New iPhone. Transferred everything over Bluetooth. My banking app was fine. Authy was completely locked. Every token locked behind a backup password I couldn't remember. My AWS root account lived inside that app. This was the root account, not an IAM user I could just recreate.

Never took recovery codes seriously. Got my phone number, got my email. As long as Gmail works, nothing is truly lost. Authy just proved that wrong.

circular logic

AWS has a process for lost MFA: email verification, then a phone call. Submitted the form. Got the email. No call. Tried three times. Nothing.

Help docs all said the same thing: log in from another device and disable MFA. Filing a support case requires being logged in. To log in, need MFA.

There's no way out of that.

the CLI hack

Still had root access keys in the CLI. Created an IAM user, gave it PowerUserAccess and IAMFullAccess, set a console password with aws iam create-login-profile. Logged in. Navigated to Root access management.

I spent twenty minutes thinking I'd cracked it.

The button was greyed out. Only the root user can manage root credentials. It's hardcoded. Root stays root, and nothing overrides that.

support

Created a new AWS account just to file a case. Got an AI-generated reply linking the MFA recovery form. The form I already filled out. Three times. Reached a person, wrong team. Reached another person, still wrong team. Got into an argument with one of them.

Finally a chat agent connected me to the actual MFA team. They needed to call. Gave them my number and my brother's as backup. Brother picked up while driving. Couldn't understand a word. Put it on speaker, neither could I. My phone? Silent.

The chat agent asked: "Do you have international calling enabled?"

"Do you have international calling enabled?"

"Do you have international calling enabled?"

Called the telecom provider. International incoming calls disabled by default. Spent half an hour flipping that switch. MFA team called back, thick accent, switched to email. They sent an OTP. Typed it in.

Three hours total. A spare AWS account, an argument with support, a telecom call, and my confused brother.

the actual ending

Went back to Authy. Typed one of my usual passwords.

And it just worked.

Went from "I'm a fucking genius" to "I'm an idiot" in three hours.

The answer was the first password I should have tried.