It's for the personal AWS accounts of the employees that leave (the sub accounts in consolidated billing). Not the root credentials for our main account.