AWS asks you to use a company phone number, and explains why

What AWS publishes about the number

AWS names no VoIP rule. What it states is capability and reachability: “You must be able to receive calls and SMS messages at this phone number”, and “This number is used for identity verification purposes and to confirm the ownership of your account” (AWS). On the page for updating the primary contact it adds one explicit exclusion: “For security purposes, phone numbers must be capable of receiving SMS from AWS. Toll free numbers will not be accepted since most don't support SMS” (AWS).

Sign-up verification runs over either channel: “Part of the sign-up procedure involves receiving a phone call or text message and entering a verification code on the phone keypad” (AWS). In the console the SMS path is a button marked Send SMS (AWS).

The sentence this whole page exists for

• AWS, on signing up

  “If this account is for a business, use a corporate phone number so that your company can retain access to the AWS account”

  https://docs.aws.amazon.com/accounts/latest/reference/getting-started.html

• AWS, on the primary contact

  “Configuring the account's root user with an individual's email address or phone number can make your account difficult to recover if that individual leaves the company.”

  https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact-primary.html

Almost nobody does this, because most companies have no phone number of their own that receives texts. That gap — a business that needs a number the business holds, and has nothing but personal handsets — is the reason a line like Cleat's exists.

One caveat AWS prints for multi-account setups: “It's best practice to use a unique phone number for each account when you use a multi-account environment” (AWS). One line across a dozen AWS accounts is against AWS's own guidance, and a Cleat subscription is one line, so plan accordingly.

SMS is not an MFA method at AWS any more

This is the fact most articles about AWS and phone numbers have not caught up with. AWS's IAM guide states plainly: “AWS ended support for enabling SMS multi-factor authentication (MFA)”, that “MFA is enforced for all account types for their root user”, and that “We recommend that you use phishing-resistant MFA such as passkeys and security keys whenever possible” (AWS). The supported types are passkeys and security keys, virtual authenticator apps, and hardware TOTP tokens.

So the number on an AWS account is not your second factor. It is your identity at sign-up and your lifeline at recovery — which, if anything, makes who holds it matter more rather than less.

Recovery: a phone call, and a limit worth knowing

If the root user's MFA device is lost, AWS verifies you “by verifying your identity using the email and the primary contact phone number registered with your account”, and the flow is a call: “To verify your primary contact phone number, choose Call me now.” Without both, “you must contact AWS Support” (AWS).

AWS's own advice on the same page is the right one either way: “We recommend that you keep the email address and contact phone number linked to your root user up to date for a successful account recovery.” Verification by phone call covers which services read codes out loud and what a transcript looks like when they do.

Changing the number on the account

For a standalone or management account, from AWS's documentation (AWS):

1. 01Sign in as an IAM user or role with permission to read and write contact information.
2. 02Choose your account name in the top right, then Account.
3. 03Scroll to Contact information and choose Edit.
4. 04Change the phone number, then choose Update.

For an account inside an organisation, the same fields are edited from the AWS Organizations console under the account's Primary contact, which needs an all-features organisation and trusted access for AWS Account Management.

Where a Cleat line fits

Exactly where AWS says it should: as the corporate number on a business account, so the root user does not depend on one person's handset. A Cleat line is a real US mobile number, not VoIP, held by one identity-verified person and readable by a team in a shared inbox, at $24.99 a month. For an engineering team, webhooks and the API put the sign-up code where a process can read it rather than where one person has to notice it.

When Cleat is the wrong answer here

• You need to key digits into a recovery call. Covered above: a receive-only line cannot do it. Keep a real handset for the root recovery path.
• You run many AWS accounts. AWS asks for a unique number per account in a multi-account environment. One subscription is one line.
• You are looking for MFA. AWS ended SMS MFA. Use a passkey, a security key or an authenticator app, which are better anyway.
• Toll-free is what you have. AWS says toll-free numbers are not accepted. So does most of this category, quietly.

Keep reading

GitHub · OpenAI · GoDaddy · Every service in this section