I made a huge fuss with AWS 5 years ago to make it possible to separate retail and AWS accounts, and they finally did it.

Huge pain point solved for founders who started companies signing up for AWS using their retail account, and later need to separate the root account (until this week, it wasn’t possible)

Sharing the email since I can’t find an official announcement.

—

Greetings from Amazon Web Services,

In the past, you have used the same email address and password to sign in to Amazon.com and AWS. In response to customer feedback, AWS is updating your account to make your access to Amazon.com and AWS independent. You can continue using this email address and your current password to sign in to Amazon.com. However, the next time that you sign in to AWS, you will be prompted to create a new password and will have the option to register a new multi-factor authentication (MFA) device. MFA is a best practice that adds an extra layer of protection on top of your email and password.

AWS will never email you and ask you to disclose your password. You will see the prompts to create a new password and register a new MFA device only when you visit the AWS Console at https://console.aws.amazon.com which will direct you to our secure sign-in experience hosted on the signin.aws subdomain.

This update to your AWS account also gives you the option to secure your AWS sign-in with additional MFA device types such as hardware security keys [1]. In addition, this update can help you monitor root user activity with AWS CloudTrail at no additional cost [2].

[1] To learn more about the types of MFA supported on AWS, visit our AWS IAM MFA User Guide: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html

[2] To learn more about about monitoring sign-in events to the Console, visit our AWS CloudTrail User Guide: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html