Description

Ensure that the AWS account root user is not used for everyday tasks. The last root use is read from the IAM credential report and is flagged if it is 1 day old or less in whole days (up to about 48 hours ago). Access key last-used dates are only checked if the password has never been used. Daily administration should be done with IAM roles, IAM Identity Center or IAM users with least-privilege permissions instead.

Rationale

The root user has unrestricted access to every resource and setting in the account, and its permissions cannot be limited by IAM policies. Regular use increases the chance that its credentials are stolen or misused, leading to data exfiltration, tampering, resource deletion and billing changes, and makes unusual root activity harder to spot. The root user should be protected with MFA, have no access keys, be monitored with sign-in alerts and be used only for tasks that require it.

Impact

  • Reduces the risk of full account compromise through the root credentials

  • Makes any root activity unusual and easy to detect and investigate

  • Administrators need IAM roles, IAM Identity Center or IAM users with suitable permissions for daily work

  • Tasks that can only be performed by the root user are still possible when needed

Default Value

Every AWS account has a root user with a password, created when the account is opened. AWS does not restrict or alert on its use by default.

Pre-Requisites

  • IAM permissions: iam:GenerateCredentialReport and iam:GetCredentialReport

  • IAM roles, IAM Identity Center users or IAM users with administrative permissions for daily tasks

  • Access to the root user credentials and MFA device, held by the people responsible for the account

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Credential report in the left menu.

  3. Choose Download credentials report and open the CSV file.

  4. In the row for user <root_account>, check the values of password_last_used, access_key_1_last_used_date and access_key_2_last_used_date.

  5. If the last use is 1 day old or less in whole days, based on password_last_used or, only if that value is no_information, on the access key dates, follow the implementation steps.

CLI:

Generate a new credential report:

aws iam generate-credential-report

Download the report (it is returned base64-encoded; decode the saved file to read the CSV):

aws iam get-credential-report --query Content --output text > credential-report.b64

The account fails if the <root_account> row shows a last use that is 1 day old or less in whole days (up to about 48 hours ago). The date in password_last_used is used whenever the password has ever been used; only if it is no_information is access_key_1_last_used_date used, and then access_key_2_last_used_date, so a recent access key use is not detected when the password has been used in the past.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Make sure that administrators have IAM roles, IAM Identity Center access or IAM users with the permissions they need for daily tasks.

  3. Sign in as the root user, choose the account name at the top right and select Security credentials.

  4. Under Multi-factor authentication (MFA), assign an MFA device if none is assigned.

  5. Under Access keys, delete all root access keys.

  6. Sign out of the root user and use it only for tasks that require root credentials.

  7. Set up an alert on root user sign-ins, for example with an Amazon EventBridge rule or a CloudWatch alarm on CloudTrail events.

Backout Plan

No configuration needs to be reverted. If a task requires the root user:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com as the root user, using MFA.

  2. Perform only the task that requires root credentials.

  3. Sign out of the root user.

Note: deleted root access keys cannot be restored. Creating new root access keys is not recommended and re-introduces the risk.

Reference