Profile Applicability: Level 1


Description: 

The root account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the root account be removed.


Rationale: 

Removing access keys associated with the root account limits vectors by which the account can be compromised. Additionally, removing the root access keys encourages the creation and use of role based accounts that are least privileged. 


Audit: 

Perform the following to determine if the root account has access keys: Via the AWS Console 

1. Login to the AWS Management Console 

2. Click Services 

3. Click IAM 

4. Click on Credential Report 

5. This will download an .xls file which contains credential usage for all IAM users within an AWS Account - open this file 

6. For the  user, ensure the access_key_1_active and access_key_2_active fields are set to FALSE.


Remediation:

Perform the following to delete or disable active root access keys being Via the AWS Console 

1. Sign in to the AWS Management Console as Root and open the IAM console at https://console.aws.amazon.com/iam/. 

2. Click on  at the top right and select Security Credentials from the drop down list 

3. On the pop out screen Click on Continue to Security Credentials 

4. Click on Access Keys (Access Key ID and Secret Access Key) 

5. Under the Status column if there are any Keys which are Active 

1. Click on Make Inactive - (Temporarily disable Key - may be needed again) 

2. Click Delete - (Deleted keys cannot be recovered)


References: 

1. http://docs.aws.amazon.com/general/latest/gr/aws-access-keys-bestpractices.html 

2. http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html 

3. http://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary. html 

4. CCE-78910-7 

5. CIS CSC v6.0 #5.1 


CIS Controls:

4.3 Ensure the Use of Dedicated Administrative Accounts 

Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities.