# 1.7 Eliminate Use of the 'Root' User for Administrative and Daily Tasks (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233107-1-7-eliminate-use-of-the-root-user-for-administrative-and-daily-tasks-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 1](https://support.icompaas.com/support/solutions/folders/62000169194) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 1** ## **Description:** When an AWS account is created, a root user is also created. This user cannot be disabled or deleted and has unrestricted access to all resources within the account. To align with the principle of least privilege and separation of duties, it is highly recommended that the root user is not used for daily administrative or operational tasks. Instead, IAM users and roles should be created with appropriate permissions. ## Rationale: - The root user has full administrative control over an AWS account. - Using the root user increases the risk of account compromise. - Principle of Least Privilege: Administrative access should be restricted to IAM roles instead of using root. - Separation of Duties: Using the root user bypasses all access controls, making tracking difficult. ## Impact: - Failure to restrict root user usage increases the risk of account takeover if credentials are leaked. - No way to restrict actions performed by the root user, leading to potential misconfigurations or accidental deletions. - Compliance issues with security frameworks (e.g., CIS, SOC 2, ISO 27001) that require proper role-based access control. ## Default Value: By default, AWS allows root user access without restrictions. - Root user credentials and access keys can be used unless explicitly removed. - IAM roles must be manually created to replace root user access. ## Pre-Requisites: 1. AWS Account Access: - IAM user with Administrator permissions (AdministratorAccess). - Root user must be available for initial setup. 2. IAM Users and Roles Configured: - Create IAM administrators for daily administrative tasks. - Implement IAM roles for specific tasks (e.g., billing, security, support). 3. MFA on Root User: - Enable MFA on root to add an extra security layer. 4. CloudTrail and AWS Config: - Monitor root account activity using AWS CloudTrail and AWS Config rules. ## Remediation: ### Test Plan: ## Using AWS Console: 1. Login to AWS as an IAM administrator. 2. Open the IAM Console: [AWS IAM Console](https://console.aws.amazon.com/iam/). 3. In the left panel, click Credential Report.                         ![](https://support.icompaas.com/assets/kb/16a53aaadd44bb52.png) 4. Click Download Report.              ![](https://support.icompaas.com/assets/kb/78a87215483c2950.png) 5. Open the CSV file and find the  row. 6. Review the following fields: - password\_last\_used → Indicates the last root login. - access\_key\_1\_last\_used\_date and access\_key\_2\_last\_used\_date → Indicates when root keys were last used. ## Using AWS Command Line : Generate a credential report: aws iam generate-credential-report Retrieve the credential report: aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,5,11,16 | grep -B1 '' Review the following fields: - password\_last\_used - access\_key\_1\_last\_used\_date - access\_key\_2\_last\_used\_date ## Implementation Steps: Step 1: Stop Using the Root User - Ensure that IAM users and roles are created to replace root user functions. - Educate administrators to use IAM roles instead of root. Step 2: Change the Root User Password 1. Sign in to AWS Console as the root user. 2. Click on your account name (top-right corner). 3. Select My Security Credentials.                ![](https://support.icompaas.com/assets/kb/25ccecdd1e4fce8f.png) 4. In the Password section, click Change password.                     ![](https://support.icompaas.com/assets/kb/51ff4657222dffe0.png)                     5. Enter a strong password and confirm.                  ![](https://support.icompaas.com/assets/kb/354068f1962959a2.png) Step 3: Delete Root Access Keys - List root access keys: aws iam list-access-keys --user-name root - Delete each access key: aws iam delete-access-key --user-name root --access-key-id - Confirm root access keys are removed: aws iam get-account-summary | grep "AccountAccessKeysPresent" - Expected output: "AccountAccessKeysPresent": 0 ## Backout Plan: If issues occur after restricting root access: 1. Temporarily enable root login (only if necessary). 2. Review IAM permissions to ensure administrators have access. 3. Restrict root access again once IAM roles are validated. ## References: - [AWS IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) - [Managing AWS Root User](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html) - [AWS Tasks Requiring Root Access](https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

5.4

Restrict administrator privileges to dedicated administrator accounts.

CIS v7

4.3

Ensure the use of dedicated administrative accounts.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.