1634502 - Please decommission AWS account "Kai Engert - 8100" (315031162935)

Status: RESOLVED FIXED

(Cloud Services :: Operations: AWS Account Request, task)

Description

[Gene Wood [:gene]]

Kai had indicated in Bug 1633075 that there may be steps already in place to terminate the "Kai Engert - 8100" (315031162935) AWS account. If so and there's a bug tracking that, feel free to close this a duplicate. If not feel free to use this bug to track it.

Comment 1

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

Attachment: MFACompanyIdentityVerificationFormAffidavit.doc

Comment 2

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

AWS requires a note from a non-insignificant deity to login to an account that no longer has the root credentials available and we do not have the root credentials for this account.

While I jest, they do actually require a notarized form filed by a corporate officer in order to release the account. Due to the very weird circumstances of 2020, this has been a bit harder to get than it normally would be.

We are also trying to do the same for another AWS account (the See Also's above).

Legal has granted their approval for this process in a separately filed bug.

Unfortunately, no timeline on finishing this. It's in the queue and I'll do my best to get it done, but I have no idea how long it will take.

Comment 3

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

(form attached)

Comment 4

[Gene Wood [:gene]]

:ckolos
I can get into this account as an admin (though not as root). Do you mind if I go in and either

• delete the IAM users that are in there so as to secure the account while it's being shut down
• delete the IAM users and enable SSO granting some team that you're in admin in the account while it's being shutdown (if so, let me know the LDAP group name you'd like)

Just looking to reduce the attack surface while it's being shut down.

Comment 5

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

That works for me.

We have literally no non-painful way to shut this crap down without root access and I have no role-assumption access into the account.

Comment 6

[Gene Wood [:gene]]

I've created an IAM role, arn:aws:iam::315031162935:role/bug1634502-admin which trusts the 361527076523 AWS account that you should have a user in. The role has admin rights so you can get admin in the account

I've deleted both dueno and kengert IAM Users as they had admin rights, hadn't logged in in months or years and had no API keys.

:ckolos, this doesn't get you root but it does mitigate risk with those two IAM users and gets you admin in the account which may help in getting it shut down.

Comment 7

[Chris Kolosiwsky [:ckolos] (ckolos has left the building)]

So yes, I now have access to the IAM, but this sadly doesn't get me any closer to root access which is what's needed to close the account.

Comment 8

[Brian Pitts]

Oremj, I had service desk swap me in as owner of all google groups that limed owned.

That put me in the google group for email to this AWS account. I added you to it too.

It appears to be an account under cloudops rather than old IT billing.

Comment 9

[Jason Thomas [:jason]]

I was able to gain access to this account as root. I will now proceed with decommission.

Comment 10

[Jason Thomas [:jason]]

Done. I've received a confirmation email "This e-mail confirms that you have closed your Amazon Web Services account."

Comment 11

[ckolos]

Created this account to say "yasssssssssss"

Comment 12

[Gene Wood [:gene]]

Epic! Thanks Jason. Also Hi ckolos!!