Description

Ensure that the AWS account root user is protected by a hardware multi-factor authentication (MFA) device, such as a FIDO security key or a hardware TOTP token, and that no virtual MFA device (authenticator app) is assigned to it. Only a root user that has a password or an active access key is evaluated.

Rationale

The root user has unrestricted access to every resource and setting in the account. Without MFA, a stolen root password or access key allows full account takeover. A virtual MFA device runs on a phone or computer that can be compromised, lost or restored from a backup, which weakens the second factor. A dedicated hardware device that is stored securely gives the strongest protection. The root user should also not be used for daily tasks, and its access keys should be removed.

Impact

  • Gives the root user the strongest available second factor

  • Root sign-in requires physical access to the hardware device, so the device must be stored securely and its availability planned for emergency access

  • Removing the virtual MFA device means it can no longer be used to sign in as the root user

  • For member accounts in AWS Organizations with centralized root access enabled, the root credentials can be removed instead, after which the root user is no longer evaluated

Default Value

A new AWS account's root user has no MFA device assigned. A hardware MFA device must be purchased and registered separately.

Pre-Requisites

  • Ability to sign in as the root user (account email address and password)

  • A hardware MFA device: a FIDO security key or a hardware TOTP token

  • IAM permissions to review the result: iam:GetAccountSummary and iam:ListVirtualMFADevices

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console as the root user.

  2. Open the account menu in the top right and choose Security credentials.

  3. In the Multi-factor authentication (MFA) section, review the type of each assigned device.

  4. If no MFA device is assigned, or any assigned device is a virtual device (authenticator app), follow the implementation steps.

CLI:

Show the account summary and check the value of AccountMFAEnabled (1 means MFA is enabled for the root user):

aws iam get-account-summary

Show any virtual MFA device assigned to the root user:

aws iam list-virtual-mfa-devices --assignment-status Assigned --query "VirtualMFADevices[?User.Arn=='arn:aws:iam::<ACCOUNT_ID>:root'].SerialNumber"

The account fails if the root user has a password or an active access key and either AccountMFAEnabled is 0, or a virtual MFA device is assigned to the root user (even if a hardware device is also assigned).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console as the root user, using the account email address.

  2. Open the account menu in the top right and choose Security credentials.

  3. In the Multi-factor authentication (MFA) section, choose Assign MFA device.

  4. Enter a device name, select Passkey or security key or Hardware TOTP token and choose Next.

  5. Follow the prompts to register the device:

    • for a security key, insert or tap the key when asked,

    • for a hardware TOTP token, enter the serial number and two consecutive MFA codes.

  6. Choose Add MFA (or Assign MFA) to finish.

  7. Sign out and sign in again as the root user with the new hardware device to confirm it works.

  8. In the Multi-factor authentication (MFA) section, select each virtual MFA device and choose Remove.

Backout Plan

  1. Sign in to the AWS Management Console as the root user.

  2. Open the account menu in the top right and choose Security credentials.

  3. In the Multi-factor authentication (MFA) section, choose Assign MFA device, select Authenticator app and register the virtual MFA device again.

  4. If required, select the hardware device and choose Remove.

Note: rolling back to a virtual MFA device weakens protection of the root user. Never leave the root user without any MFA device.

Reference