# 1.4 Ensure No 'Root' User Account Access Key Exists (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233151-1-4-ensure-no-root-user-account-access-key-exists-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 1](https://support.icompaas.com/support/solutions/folders/62000169194) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 1** ## **Description:** The AWS root user is the most privileged account in an AWS environment. AWS Access Keys provide programmatic access to an AWS account, and having access keys associated with the root user poses a severe security risk. It is recommended to delete all access keys associated with the root user to enforce principle of least privilege and minimize attack vectors. ## Rationale: - Root user access keys are a high-risk attack vector and can be used to gain full access to AWS resources. - If compromised, attackers can completely control the AWS account, leading to data breaches, unauthorized modifications, and service disruptions. - AWS Best Practices discourage the use of root user access keys and encourage the use of IAM roles and least-privileged accounts instead. ## Impact: - Failure to remove root access keys increases the risk of account takeover if these credentials are leaked or misused. - Accidental use of root access keys may expose them in logs or repositories. - Using root access keys circumvents IAM policies and monitoring, making tracking difficult. ## Default Value: By default, AWS does not create access keys for the root user. However, users can manually create them. ## Pre-Requisites: 1. AWS Account Access: - IAM user with Security Credentials access or root user. - IAM permissions: iam:GetAccountSummary, iam:ListAccessKeys, iam:DeleteAccessKey. 2. Security Policy: - Organization policy should restrict root access key creation and enforce regular audits. 3. Monitoring & Alerting: - AWS Config, AWS CloudTrail, or GuardDuty should be set up to alert on new root access key creation. ## Remediation: ### Test Plan: ## Using AWS Console: 1. Login to the AWS Management Console. 2. Navigate to IAM Console: [AWS IAM Console](https://console.aws.amazon.com/iam/).                ![](https://support.icompaas.com/assets/kb/dba568f3100bb9f5.png) 3. Click Credential Report (under "Access Reports").                   ![](https://support.icompaas.com/assets/kb/77bf8a2775ecc6d7.png) 4. This will download a CSV file containing credential usage for all IAM users.                 ![](https://support.icompaas.com/assets/kb/fb12755818c15e96.png) 5. Open the CSV file and check the following fields for the  user: - access\_key\_1\_active → Should be FALSE - access\_key\_2\_active → Should be FALSE ## Using AWS CLI - Run the following AWS CLI command: aws iam get-account-summary | grep "AccountAccessKeysPresent" - If no root access keys exist, the output will be:  "AccountAccessKeysPresent": 0 - If the output shows "1", then root access keys exist and should be deleted. ## ## Implementation Steps: ## Using AWS Console 1. Login to AWS as the root user. 2. Open the IAM Console: [AWS IAM Console](https://console.aws.amazon.com/iam/) 3. Click on Root Account Name (top-right corner) → Select My Security Credentials.                               ![](https://support.icompaas.com/assets/kb/a7c09efbae3a0747.png) 4. In the Security Credentials page, click Continue to Security Credentials 5. Scroll down to Access Keys (Access Key ID and Secret Access Key).                ![](https://support.icompaas.com/assets/kb/df4e1c26bcb8b50a.png) 6. If active access keys exist, under Status, click Delete. ![](https://support.icompaas.com/assets/kb/a1db4cf53f477f70.png) 7. Confirm deletion (Note: Deleted keys cannot be recovered). ## Using AWS Command Line  Run the following command to list root access keys:     aws iam list-access-keys --user-name root If any access keys are returned, delete them using: aws iam delete-access-key --user-name root --access-key-id Verify removal by rerunning the audit command: aws iam get-account-summary | grep "AccountAccessKeysPresent Backout Plan: If a valid root access key was mistakenly deleted, follow these steps: 1. Login as root user via the AWS Management Console. 2. Generate a new root access key (not recommended unless absolutely necessary). 3. Immediately store the new access key securely (preferably offline). 4. Limit use and consider transitioning to an IAM role-based approach instead. ## References: - [AWS Access Key Best Practices](http://docs.aws.amazon.com/general/latest/gr/aws-access-keys-bestpractices.html) - [Managing AWS Access Keys](http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html) - [AWS IAM GetAccountSummary API](http://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html) - [AWS Blog: Identifying AWS Root User Access Keys](https://aws.amazon.com/blogs/security/an-easier-way-to-determine-the-presence-of-aws-account-access-keys/) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

5.4

Restrict administrator privileges to dedicated administrator accounts.

CIS v8

6.8

Define and maintain role-based access control, ensuring least privilege access.

CIS v7

4.3

Ensure the use of dedicated administrative accounts.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.