Description

Ensure that the AWS account root user has no active access keys. Root access keys give programmatic access to the account with the full, unrestricted permissions of the root user. All automation and API access should use IAM roles or other identities with temporary credentials and least-privilege permissions instead.

Rationale

Root access keys provide unrestricted API access that cannot be limited by IAM policies. If they are leaked or misused, an attacker can turn off logging, change policies, read and export data, delete resources and lock administrators out of the account. Long-lived keys can remain exposed for a long time, and API calls signed with them are not protected by the root user's console MFA. Deleting root access keys and using IAM roles with temporary credentials removes this risk.

Impact

  • Removes the most powerful long-lived credential from the account

  • Any script or application that still uses the root access keys stops working and must be moved to an IAM role or user first

  • No effect on signing in to the console as the root user

Default Value

The root user has no access keys by default. Root access keys exist only if they were created manually.

Pre-Requisites

  • Root user credentials and MFA device, because only the root user can delete its own access keys

  • IAM permissions for testing: iam:GenerateCredentialReport, iam:GetCredentialReport and iam:GetAccountSummary

  • A list of the scripts or applications that use the root access keys, and IAM roles or users ready to replace them

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Credential report in the left menu.

  3. Choose Download credentials report and open the CSV file.

  4. In the row for user <root_account>, check the values of access_key_1_active and access_key_2_active.

  5. If either value is true, follow the implementation steps.

CLI:

Check whether the root user has any access keys (in the output, AccountAccessKeysPresent is 1 if at least one key exists):

aws iam get-account-summary --query "SummaryMap"

Generate and download the credential report to see whether the keys are active (the content is base64-encoded; decode the saved file to read the CSV):

aws iam generate-credential-report
aws iam get-credential-report --query Content --output text > credential-report.b64

The account fails if access_key_1_active or access_key_2_active is true for <root_account>. Accounts whose root user has no password and no access keys are not evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com as the root user.

  2. Choose the account name at the top right and select Security credentials.

  3. In the Access keys section, check the Last used information of each key and move any script or application that still uses it to an IAM role or user.

  4. For each key, choose Actions, then Deactivate, and confirm that nothing breaks.

  5. Choose Actions, then Delete, and confirm the deletion.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com as the root user.

  2. Choose the account name at the top right and select Security credentials.

  3. If a key was only deactivated, choose Actions, then Activate.

Note: a deleted access key cannot be restored. Creating new root access keys is not recommended and re-introduces the risk.

Reference