AWS Root User Email: Which Address to Use, the Verification Code, Changing It Later

Updated October 13, 2026 · 6 min read

Every AWS account has one root user, and its email address does more than receive a sign-up code. It is the root user's sign-in name, the account's recovery channel and the address AWS sends bills and warnings to. No two AWS accounts can share it, member accounts in AWS Organizations included. So the useful question is not only "which address passes verification" but "who should own this address a year from now".

What the root user email is used for

Signing in as root. The email is the root user's sign-in name.
Recovery. Getting back into the account runs through this address.
Money and status. Invoices, Free Tier and usage alerts, and notices about the account's status arrive here.
Security codes. Without root MFA, a root sign-in from an unfamiliar location triggers a code sent to this address.

That is why an organization's account is better off with an address that stays with the organization when people change jobs, not one employee's personal inbox.

Choosing the address: one root email per account

The account is…	Root email that fits	Why
Your company's production account	A shared address the organization controls	Billing and recovery survive staff changes
Built by you for a client	Yours while building, the client's own address at handover	The new address must receive AWS's verification code
A short dev/test account or Free Tier lab for your own project	A rented address for the code step, changed if the account stays	Invoices and alerts should not go to an inbox you cannot read

Whatever you pick, the address must not already belong to another AWS account, or AWS refuses it. AWS accepts both @gmail.com and @icloud.com, so either inbox type works for the code step. Keep to one account per real client, project or environment, within AWS's terms. Free Tier and new-account offers follow AWS's own conditions, not the email behind the account, and opening accounts only to repeat a promotion is not legitimate use.

The "AWS Email Verification" step, start to finish

On the sign-up page you enter the root user email address and an AWS account name, then press "Verify email address". AWS sends a message titled "AWS Email Verification" with a 6-digit code, and you type it in before you can set the root password. If the page sits idle too long, AWS asks for a new code; always use the newest one.

The email is only the first gate. Next come contact details, a payment card (usually with a small temporary hold) and a phone number confirmed by SMS or an automated call. Finally AWS emails a notice once the account is active. That notice is not a code, so don't wait for it on a rental order page.

When the root address is a rented one:

Open the AWS form first. The countdown starts as soon as the inbox is assigned, so have the card and phone ready and finish the email step in one sitting.
Watch the order row. It shows "Waiting for code"; the code then appears as a chip you click to copy, with "View email" for the full message. For AWS, 85% of orders received a code in the last 30 days, typically after about 1 minute.
If nothing comes, the rent form's rule applies: "No code in 25 minutes? Auto-cancelled with a 100% refund." If AWS says the address is already in use, cancel before the first code for a full refund and rent another.

Changing the root email later, and handing an account over

Sign in as the root user, click the account name in the console and open the Account page. Under Account details, open Actions and choose "Update email address and password". AWS sends a verification code to the new address, which is exactly why the new owner has to be able to read it: do the change together with the client, on the day you hand over.

A short handover checklist:

Turn on MFA for the root user.
Create IAM users for day-to-day work, so nobody needs root for routine tasks.
Move the root email to the client's own address and let them confirm the code.
Update the root password with them in the same step.

Need a client or teammate to read a code that reaches the rented root address while you are still setting up? Switch on a share code on your Account page: they enter it together with the email at otpgmail.net/otp to see the codes without an account. Viewing codes there never charges you; renting a cancelled address again through the link works only if you allow it on the Account page, and then it is charged to your balance. Each order row also has a "Share" button that copies a code link for that email; cancelled orders and orders older than 30 days can no longer be shared.

Renting a root address for the verification step

The AWS page has the rental steps, the live price and stock for Gmail and iCloud. If you would rather script the rental than click through the web form, call POST /v1/orders with {"service": "aws"} and poll GET /v1/orders/{orderId} until the code appears; the email OTP API guide for testing walks through that flow. Extra codes cost nothing within the order period when the service sends more than one; the limit and time window are shown before you rent.

Frequently asked questions

Does an AWS Builder ID verify its email the same way?

Yes. Builder ID sign-up also confirms the address with a 6-digit code ("Verify your AWS Builder ID email address"). It is a personal developer profile you will likely keep for years, so your own address is usually the better fit there.

Once root MFA is on, does the root email still matter?

Yes. MFA replaces email codes when you sign in as root, but recovery, invoices and account alerts still go to the root email. That is why the address has to stay readable for as long as the account exists.

Can I read AWS invoices in the rented inbox later?

No. A rented inbox has no password and you never sign in to it; you see what arrives during the order window, on your order page. Move the root email to your own address before invoices start.

Setting up the root email now? Rent an inbox, check live prices and stock, or read the API docs.