Default password new AWS organization account

Question

I have a Terraform script that allows me to create new AWS accounts inside organizations using aws_organization_account resource. I do not have any problem when creating that new account but I am wondering what is the initial password to logging as a root user into the new account? Is there a way to set one? I currently need to click on "I forgot my password" if I want to logging as a root user with my email.

main.tf

resource "aws_organizations_account" "this" {
  name      = "user1"
  email     = "[email protected]"
  parent_id = module.organizations.sandbox_organizational_unit_id
}

After that I am going into the AWS logging page, log as a root user with [email protected] and click on "I forgot my password" since I don't know the inital password

Answer 1

No, there is no way to set one initially, your process is the one the official aws docs also recommend:

When you create an account, AWS Organizations initially assigns a long (64 characters), complex, randomly generated password to the root user. You can't retrieve this initial password. To access the account as the root user for the first time, you must go through the process for password recovery. For more information, see Accessing a member account as the root user.

It may however not be necessary to login as root anyway since

AWS Organizations automatically creates an AWS Identity and Access Management (IAM) role in the member account. This role enables IAM users in the management account who assume the role to exercise full administrative control over the member account.

And generally setting / configuring passwords in terraform is risky because the password would show up in the state files and in the version control system you hopefully check your terraform files into.