# Ensure the root account has no active access keys

- Source: https://support.icompaas.com/support/solutions/articles/a_179329221193892-ensure-the-root-account-has-no-active-access-keys
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the AWS account root user has no active access keys. Root access keys give programmatic access to the account with the full, unrestricted permissions of the root user. All automation and API access should use IAM roles or other identities with temporary credentials and least-privilege permissions instead.

**Rationale**

Root access keys provide unrestricted API access that cannot be limited by IAM policies. If they are leaked or misused, an attacker can turn off logging, change policies, read and export data, delete resources and lock administrators out of the account. Long-lived keys can remain exposed for a long time, and API calls signed with them are not protected by the root user's console MFA. Deleting root access keys and using IAM roles with temporary credentials removes this risk.

**Impact**

-   Removes the most powerful long-lived credential from the account
    
-   Any script or application that still uses the root access keys stops working and must be moved to an IAM role or user first
    
-   No effect on signing in to the console as the root user
    

**Default Value**

The root user has no access keys by default. Root access keys exist only if they were created manually.

**Pre-Requisites**

-   Root user credentials and MFA device, because only the root user can delete its own access keys
    
-   IAM permissions for testing: iam:GenerateCredentialReport, iam:GetCredentialReport and iam:GetAccountSummary
    
-   A list of the scripts or applications that use the root access keys, and IAM roles or users ready to replace them
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Credential report** in the left menu.
    
3.  Choose **Download credentials report** and open the CSV file.
    
4.  In the row for user <root\_account>, check the values of access\_key\_1\_active and access\_key\_2\_active.
    
5.  If either value is true, follow the implementation steps.
    

**CLI:**

Check whether the root user has any access keys (in the output, AccountAccessKeysPresent is 1 if at least one key exists):

aws iam get-account-summary --query "SummaryMap"

Generate and download the credential report to see whether the keys are active (the content is base64-encoded; decode the saved file to read the CSV):

aws iam generate-credential-report  
aws iam get-credential-report --query Content --output text > credential-report.b64

The account fails if access\_key\_1\_active or access\_key\_2\_active is true for <root\_account>. Accounts whose root user has no password and no access keys are not evaluated.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/) as the root user.
    
2.  Choose the account name at the top right and select **Security credentials**.
    
3.  In the **Access keys** section, check the **Last used** information of each key and move any script or application that still uses it to an IAM role or user.
    
4.  For each key, choose **Actions**, then **Deactivate**, and confirm that nothing breaks.
    
5.  Choose **Actions**, then **Delete**, and confirm the deletion.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/) as the root user.
    
2.  Choose the account name at the top right and select **Security credentials**.
    
3.  If a key was only deactivated, choose **Actions**, then **Activate**.
    

Note: a deleted access key cannot be restored. Creating new root access keys is not recommended and re-introduces the risk.

**Reference**

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_root-user\_manage\_delete-key.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user_manage_delete-key.html)
    
-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html)
    
-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_getting-report.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-summary.html](https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-summary.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.