Ownership is more than the password
After a handover you can sign in, which feels like ownership. Several other things still determine who actually controls the account, and each is a separate setting.
Work through all of them. Any one left pointing elsewhere is a path back into the account that is not yours.
The recovery path
Password reset flows send a link or code to the account’s registered email and phone number. Until both are yours, whoever holds them can reset the password regardless of what you set it to.
Change the primary email first, confirm the change actually took effect by triggering a reset to yourself, then change the phone number. Remove any secondary or alternate recovery address you did not add.
Existing credentials and keys
- Deactivate and then delete every access key you did not create
- Remove SSH keys registered on the account
- Revoke API tokens and personal access tokens
- Remove third-party OAuth grants and connected applications
- Delete additional users, IAM identities and service accounts you do not recognise
Reissue anything you actually need rather than inheriting it. An inherited credential has an unknown history.
Billing
Replace the payment method with your own and update the billing address. Check for any saved payment instrument you did not add and remove it.
Also look at whether the account belongs to an organisation or management group. On some platforms an account can sit under a parent that retains administrative rights over it, which is a form of control that survives every change you make inside the account.
Existing resources
Look at what is already running before you deploy anything. Resources you did not create will bill to you from now on, and anything left behind is worth understanding rather than ignoring.
Check every region, not just the one you plan to use. Forgotten resources in unused regions are a classic source of unexplained charges.
Verify, then close the loop
- Sign out completely and sign back in with the new credentials.
- Trigger a password reset and confirm the message arrives at your address.
- Confirm MFA is required on sign-in.
- Check the audit log for any activity after the handover that was not you.
Only once these pass is the handover genuinely complete.
Related cloud accounts
This guide applies across providers. The cloud account catalogue lists every platform with its configurations and prices, and the comparison table puts them side by side.
Further reading
- Managed Database or Self-Hosted: An Honest Comparison
- Rotating Access Keys Without Breaking Production
- Alibaba Cloud vs OVHcloud: Which Cloud Account Should You Buy?
- Azure Accounts: What You Get and How to Choose a Configuration
Frequently asked questions
The recovery email and phone number. They determine who can reset the password, so changing the password alone is not enough.
Yes, once you have confirmed your own access works and you have working recovery. Anything you cannot account for should go.
Check the billing breakdown by service and region rather than the console dashboard, which usually shows only the current region.
