# Ensure the root account has not been used in the last day - Source: https://support.icompaas.com/support/solutions/articles/a_1793292210596506-ensure-the-root-account-has-not-been-used-in-the-last-day - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that the AWS account root user is not used for everyday tasks. The last root use is read from the IAM credential report and is flagged if it is 1 day old or less in whole days (up to about 48 hours ago). Access key last-used dates are only checked if the password has never been used. Daily administration should be done with IAM roles, IAM Identity Center or IAM users with least-privilege permissions instead. **Rationale** The root user has unrestricted access to every resource and setting in the account, and its permissions cannot be limited by IAM policies. Regular use increases the chance that its credentials are stolen or misused, leading to data exfiltration, tampering, resource deletion and billing changes, and makes unusual root activity harder to spot. The root user should be protected with MFA, have no access keys, be monitored with sign-in alerts and be used only for tasks that require it. **Impact** - Reduces the risk of full account compromise through the root credentials - Makes any root activity unusual and easy to detect and investigate - Administrators need IAM roles, IAM Identity Center or IAM users with suitable permissions for daily work - Tasks that can only be performed by the root user are still possible when needed **Default Value** Every AWS account has a root user with a password, created when the account is opened. AWS does not restrict or alert on its use by default. **Pre-Requisites** - IAM permissions: iam:GenerateCredentialReport and iam:GetCredentialReport - IAM roles, IAM Identity Center users or IAM users with administrative permissions for daily tasks - Access to the root user credentials and MFA device, held by the people responsible for the account **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Credential report** in the left menu. 3. Choose **Download credentials report** and open the CSV file. 4. In the row for user , check the values of password\_last\_used, access\_key\_1\_last\_used\_date and access\_key\_2\_last\_used\_date. 5. If the last use is 1 day old or less in whole days, based on password\_last\_used or, only if that value is no\_information, on the access key dates, follow the implementation steps. **CLI:** Generate a new credential report: aws iam generate-credential-report Download the report (it is returned base64-encoded; decode the saved file to read the CSV): aws iam get-credential-report --query Content --output text > credential-report.b64 The account fails if the row shows a last use that is 1 day old or less in whole days (up to about 48 hours ago). The date in password\_last\_used is used whenever the password has ever been used; only if it is no\_information is access\_key\_1\_last\_used\_date used, and then access\_key\_2\_last\_used\_date, so a recent access key use is not detected when the password has been used in the past. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Make sure that administrators have IAM roles, IAM Identity Center access or IAM users with the permissions they need for daily tasks. 3. Sign in as the root user, choose the account name at the top right and select **Security credentials**. 4. Under **Multi-factor authentication (MFA)**, assign an MFA device if none is assigned. 5. Under **Access keys**, delete all root access keys. 6. Sign out of the root user and use it only for tasks that require root credentials. 7. Set up an alert on root user sign-ins, for example with an Amazon EventBridge rule or a CloudWatch alarm on CloudTrail events. **Backout Plan** No configuration needs to be reverted. If a task requires the root user: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/) as the root user, using MFA. 2. Perform only the task that requires root credentials. 3. Sign out of the root user. Note: deleted root access keys cannot be restored. Creating new root access keys is not recommended and re-introduces the risk. **Reference** - [https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_getting-report.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html) - [https://docs.aws.amazon.com/cli/latest/reference/iam/get-credential-report.html](https://docs.aws.amazon.com/cli/latest/reference/iam/get-credential-report.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.