Cloud Account Handover Checklist: What to Review When You Take Over an Account

Step one: secure the owner identity

Nothing else matters until you alone control the top-level identity. On AWS that is the root user, identified by an email address. On Google Cloud it is the account holding the Owner role on the project or the Organization Administrator role at organization level, plus the billing account administrator. On Azure it is the Global Administrator of the Microsoft Entra ID tenant and the Owner of the subscription. On DigitalOcean it is the account owner of the team.

1. Change the password on the owner identity and on the email account it is tied to. The email account is the recovery path for the cloud account, so it must be yours first.
2. Enable multi-factor authentication with a device you control. AWS supports hardware keys and authenticator apps on the root user; Google and Microsoft accounts support 2-Step Verification and passkeys; DigitalOcean offers authenticator app and security key options. Remove any MFA device that belonged to the previous holder.
3. Update recovery contacts. Replace the phone number, alternate email, and security questions. On AWS also update the alternate contacts for billing, operations, and security under account settings.
4. Stop using the owner identity for daily work. Create an administrative IAM user or role and sign in with that from now on.

Step two: inventory resources across every region

Cloud consoles show one region at a time, and forgotten resources hide in regions nobody opens. Walk every region, or use a tool that does it for you: AWS Resource Explorer or the Tag Editor with all regions selected, Google Cloud Asset Inventory, Azure Resource Graph Explorer, and the DigitalOcean project view. List compute instances, disks and volumes, snapshots, object storage buckets, databases, load balancers, reserved IP addresses, DNS zones, and Kubernetes clusters.

For each item, decide whether you recognise it. Unknown instances may be infrastructure you were not told about, or someone else’s workload on your bill. Do not delete on the first pass; record the inventory, then confirm each item’s purpose before removing it. Snapshots and detached volumes are the usual sources of silent cost.

Step three: review IAM users, keys, and roles

The previous holder may have created users for colleagues, service accounts for applications, and long-lived keys for scripts. Each one is a way into the account that does not go through the owner password you just changed.

• Human users. List them, confirm each is someone you know, and delete the rest. On AWS check IAM users and IAM Identity Center; on Google Cloud check IAM principals at project and organization level; on Azure check Entra ID users and guest accounts; on DigitalOcean check team members.
• Access keys and tokens. Rotate every AWS access key you keep and delete the ones you do not. On Google Cloud list service account keys and delete user-managed keys that are not needed. On Azure review app registration client secrets and certificates. On DigitalOcean revoke personal access tokens and Spaces keys you did not create.
• Roles and policies. Look for cross-account trust: an AWS role that trusts another account’s principal, a Google Cloud IAM binding to an outside domain, or an Azure guest user with a privileged role. Remove trust relationships you did not set up.
• Third-party access. Check OAuth grants and connected applications. On Google Cloud and Azure these appear under API controls or enterprise applications.

Confirm the audit log is on: AWS CloudTrail, Google Cloud Audit Logs, or the Azure Activity Log.

Step four: billing, budgets, and quotas

Open the billing console and record the current state: payment method, billing contact, invoice history, outstanding balance, and any credits with their expiry dates. On Google Cloud check which billing account each project is linked to. On Azure check the subscription’s offer type and whether a spending limit is in place. Replace the payment method and billing contact with your own.

Create a budget with alerts before the day is over. AWS Budgets, Google Cloud budgets, Azure Cost Management, and DigitalOcean billing alerts all take minutes to configure. Look for existing reservations or savings plans, which are commitments you now owe.

Then read the quotas. AWS Service Quotas, the Google Cloud Quotas page, Azure Usage + quotas, and the DigitalOcean Droplet limit show the ceilings the account currently has. Marketplace labels such as a vCPU count or a Droplet count restate what the seller listed; the console is the only reliable source for the limit today. If you need more, request an increase through the provider’s normal process.

Step five: read the terms and the acceptable use policy

Every provider publishes terms of service and an acceptable use policy, and the account holder is bound by them regardless of who created the account. Read both before you deploy. Confirm the account’s registered details are accurate and belong to you or your business, because providers verify identity and payment details and may suspend accounts whose information does not match. Confirm your workload is permitted: bulk email, cryptocurrency mining, port scanning, and content of certain kinds are restricted or forbidden on most platforms.

If the account is in a restricted or suspended state, or a provider asks for verification, respond honestly through the provider’s own process. There is no configuration that substitutes for compliance, and an account that runs outside the terms is one you can lose without notice.

The checklist in one place

1. Change the owner password and the password on its email account.
2. Enrol your own MFA device and remove the previous holder’s.
3. Update recovery email, phone, and alternate contacts.
4. Inventory resources in every region and record what you find.
5. Delete unknown users, rotate kept keys, revoke unused tokens and OAuth grants.
6. Remove cross-account trust and roles you did not create.
7. Confirm audit logging is on.
8. Replace the payment method and billing contact; note credits and commitments.
9. Create a budget with alerts.
10. Record current quotas and request increases through the provider if needed.
11. Read the terms of service and acceptable use policy and confirm your workload is allowed.

Where to go next

The listed variants for the providers covered here are on the Buy AWS Accounts page, the Buy Google Cloud Accounts page, the Buy Azure Accounts page, and the Buy DigitalOcean Accounts page. Run this checklist in the first session on any of them.

Related reading in the Cloud Library:

• Cloud account security essentials: MFA, roles, and least privilege
• Setting budgets and billing alerts on any cloud provider
• Cloud acceptable use policies: what providers expect from account holders

Browse every guide in the Cloud Library.