Source
r/aws•
ilickthings

If you suffer from The Underwear Problem (separating a store account from AWS root user)...

general aws

Sorry if this is common knowledge, I don't subscribe to this subreddit but I probably should. Your AWS Account Manager has a fix. You have to go through your rep and meet this criteria - support will tell you otherwise.

  • The AWS account is in active status and the retail account is in normal status
  • The account does not have any bank account as payment instrument
  • The account is not be registered as an AWS Marketplace seller.
  • Customer did not use the account for making any purchases in AWS Marketplace
  • The account is not registered as an EC2 Reserved instance Marketplace Seller.
  • The account does not have any MFA device configured on the AWS account.

Hopefully this is useful to people.

Posted Aug 26, 2022, 5:09 PM UTC

1626
srandrews•

One of my greatest achievements in infrastructure management was making a separate AWS Marketplace account so our supply chain person could procure, miss invoices, fail to pay and get the account suspended with no downtime to our infrastructure.

53
Quinnypig•

New Cloud Economics best practice unlocked!

19
Quinnypig•

I adore that my description of this as “the underpants problem” has caught on.

My initial framing for those who wonder was “the AWS account that runs your $100 million a year unicorn is linked to the Amazon account the founder still uses to buy underpants.”

37
i_am_voldemort•

Founder probably getting 5% back in Amazon points on $100M in AWS spend too :)

10
Quinnypig•

Above a million a year in spend AWS offers volume discounting via EDPs / PPAs. One requirement for those is that you switch to invoice payments.

Unfortunately.

6
i_am_voldemort•

Guh. There goes my hopes and dreams.

2
a1b3rt•

Of getting free underwear?

4
ilickthingsOP•

hah AWS account in my instance is on a different CC unfortunately

2
prfsvugi•

And putting it on his Amex for points for free flights to the Caribbean

1
ilickthingsOP•

fuck I knew I typoed it in the title after I posted and was hoping nobody (ESPECIALLY NOT YOU) would catch it hahah

4
eecue•

howdy u/quinnypig!

1
investorhalp•

I have a hard time understanding what are you saying.

​

I get from the comments that this is to.. separate? amazon.com and aws accounts, but I have no idea what you just said.

3
ilickthingsOP•

u/Quinnypig said it best here

2
PeacefullyFighting•

What do you do if that cto no longer works at the company?

2
rberger•

This happened to me (as the CTO). The account started back when your root AWS account was an Amazon shopping account (my Amazon shopping account). This went on as the use of AWS grew. We found that to change it, we would have to drop everything and move it to a new account. Of course we never did that.

I left the company, but the root account was still in my name. Lucky for them we were on friendly terms.

Eventually the company was bought. The account was still in my name... Would have to periodically help them out with something that required the root account.

Finally a year or so ago, they were able to disconnect my Amazon account from their AWS account!

2
PeacefullyFighting•

Thank you so much for that story. This is probably what happened

2
ilickthingsOP•

huck and pray

2
PeacefullyFighting•

Lol

2
tastycidr•

Welp, that’s the better part of a year wasted. We escalated the crap out of this including with our TAM and were told the only thing we could do was migrate our production environment out of the account…

1
hmoff•

How do you get a rep? Does this mean you have to subscribe to paid support?

We tried to request this through support and of course we were told it wasn't possible.

1
ilickthingsOP•

I opened a support ticket asking who my rep was.

3
hmoff•

thanks will try that

1
Deku-shrub•

Apparently AWS are rolling this out in phases. Our account manager says we can do this within 2-3 months :D

1
prfsvugi•

So you need to not have an MFA on it. Good way to run up a $200K bill

1
ilickthingsOP•

Just disable it before kicking off and then enable after? Rather that than having to migrate your entire infrastructure

1
a1b3rt•

Can this be done for personal accounts too ... we don't have a TAM as far as I know.

0