Skip to content


Repository files navigation

coto: An AWS Management Console Client

Documentation Status Version

Almost any AWS service can be fully controlled using the AWS API, for this we strongly recommend the use of boto3. The problem is, that there exist some administrative tasks for which there is no public API, and there exist some AWS tasks that still require the AWS Account Root User.

For example when creating a new account in an AWS Organization, there are some things that you are unable to do using the documented APIs, such as:

  • set tax registration information (no documented API)
  • set additional contacts (no documented API)
  • reset AWS Account Root User password (no documented API)
  • setup MFA for the AWS Account Root User (requires root user)


This project provides a client for the undocumented APIs that are used by the AWS Management Console. These APIs will be changing without any upfront warning! As a result of this, coto can break at any moment.


Login using a boto session.

import boto3
import coto

session = coto.Session(

Login using root user password.

import coto

session = coto.Session(
    password='s3cur3 p4ssw0rd!'

Login using root user password with virtual MFA.

import coto

session = coto.Session(
    password='s3cur3 p4ssw0rd!',

Get account information

iam = session.client('iam')

Set tax registration

billing = session.client('billing')
        'address': {
            'addressLine1': 'Adresweg 1',
            'addressLine2': None,
            'city': 'Delft',
            'countryCode': 'NL',
            'postalCode': '2600 AA',
            'state': 'Zuid-Holland',
        'authority': {'country': 'NL', 'state': None},
        'legalName': 'Besloten Venootschap B.V.',
        'localTaxRegistration': False,
        'registrationId': 'NL000000000B01',


pipenv install -d
pipenv run nosetests tests
cd docs
pipenv run make html