# Eliminate use of the 'root' user for administrative and daily

- Source: https://support.icompaas.com/support/solutions/articles/62000228287-eliminate-use-of-the-root-user-for-administrative-and-daily
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## **Description:**

With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. That user has unrestricted access to and controls over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.

## **Rationale:**

The 'root user' has unrestricted access to and control over all account resources. Use of it is inconsistent with the principles of least privilege and separation of duties and can lead to unnecessary harm due to error or account compromise.

## **Impact:**

Not using the root user for administrative and daily tasks will reduce unnecessary harm due to full access to all AWS services. 

## **Default Value:**

By default, the root account is used initially.

## **Pre-Requisite:**

Root user access.

## **Remediation:**

### **Test Plan:**

-   AWS Console Process
    

1.  Login to the AWS Management Console - IAM [https://us-east-1.console.aws.amazon.com/iam/](https://us-east-1.console.aws.amazon.com/iam/ "https://us-east-1.console.aws.amazon.com/iam/").
    
2.  In the left pane, click settings and choose Credential report. ![](https://support.icompaas.com/assets/kb/686c4c5775475a25.png) 
    
3.  Click on Download Report.  ![](https://support.icompaas.com/assets/kb/1e758be4aa9daff5.png)  
    
4.  Open of Save the file locally.
5.  Locate the under the user column.
6.  Review password\_last\_used, access\_key\_1\_last\_used\_date, access\_key\_2\_last\_used\_date to determine when the 'root user' was last used.

  

**Using AWS CLI**

The following example attempts to generate a credential report for the AWS account:

aws iam generate-credential-report  
aws iam get-credential-report --query 'Content' --output text | base64 -d |   
cut -d, -f1,5,11,16 | grep -B1 '<root\_account>'

### **Implementation Plan**:

-   AWS Console Process
    

1.  Login to the AWS Management Console as root user.
    
2.  On the top right click on the username and select Account ![](https://support.icompaas.com/assets/kb/76eb7cda65f59cb2.png) 
    
3.  In the account settings, click on edit.  ![](https://support.icompaas.com/assets/kb/3835ae19236100bf.png)  
    
4.  Enter the root user mail-id and password for authentication.
5.  Click edit under password. ![](https://support.icompaas.com/assets/kb/c0b47851bf2015ca.png) 
6.  Enter the current root user password and the new password, click on save changes. ![](https://support.icompaas.com/assets/kb/af0303a500845ae8.png) 
    
7.  Now check any access keys are there.
8.  Sign in to the [AWS Identity and Access Management (IAM) console](https://console.aws.amazon.com/iam "https://console.aws.amazon.com/iam") as the AWS account root user.
9.  Choose your account name on the navigation bar, and then choose **Security credentials**.![](https://support.icompaas.com/assets/kb/13177c906593c6a9.png)
10.  Expand Access keys to check any access keys are there. ![](https://support.icompaas.com/assets/kb/8f336f98b1d8d163.png) 
     
11.  If present, click on delete under Actions and select Deavtivate. ![](https://support.icompaas.com/assets/kb/2f5f44e6c3e68c58.png) 
     
12.  To confirm deletion, enter the access key ID in the text input field and click on delete.  ![](https://support.icompaas.com/assets/kb/be9e710a24e9c698.png)  
     

  

  

**Using AWS CLI**

**changing root user password is not available through AWS CLI.**

The following `delete-access-key` command deletes the specified access key (access key ID and secret access key) for the IAM user named `Bob`:

aws iam delete-access-key --access-key-id AKIDPMS9RO4H3FEXAMPLE --user-name Bob

### **Backout Plan:**

For Backout Plan don’t change root user password and don’t delete access keys.

### **Note:**

The 'root' user for us-gov cloud regions is not enabled by default. However, on request to AWS support, they can enable the 'root' user and grant access only through access keys for us-gov cloud region. If the 'root' user for us-gov cloud regions is enabled, this recommendation is applicable.

## **Reference:**

[![](https://support.icompaas.com/assets/kb/08a4a436eecd7933.png)AWS account root user - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html) 

[![](https://support.icompaas.com/assets/kb/ca26f92aec9b6ed9.png)generate-credential-report — AWS CLI 1.27.109 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/iam/generate-credential-report.html) 

[Delete an Access Key (amazon.com)](https://aws.amazon.com/premiumsupport/knowledge-center/delete-access-key/#:~:text=To%20delete%20access%20keys%20for%20the%20AWS%20account,ID%20and%20secret%20access%20key%29%20section.%20More%20items "https://aws.amazon.com/premiumsupport/knowledge-center/delete-access-key/#:~:text=To%20delete%20access%20keys%20for%20the%20AWS%20account,ID%20and%20secret%20access%20key%29%20section.%20More%20items")

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.