# Ensure hardware MFA is enabled for the root account

- Source: https://support.icompaas.com/support/solutions/articles/a_179329221540034-ensure-hardware-mfa-is-enabled-for-the-root-account
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the AWS account root user is protected by a hardware multi-factor authentication (MFA) device, such as a FIDO security key or a hardware TOTP token, and that no virtual MFA device (authenticator app) is assigned to it. Only a root user that has a password or an active access key is evaluated.

**Rationale**

The root user has unrestricted access to every resource and setting in the account. Without MFA, a stolen root password or access key allows full account takeover. A virtual MFA device runs on a phone or computer that can be compromised, lost or restored from a backup, which weakens the second factor. A dedicated hardware device that is stored securely gives the strongest protection. The root user should also not be used for daily tasks, and its access keys should be removed.

**Impact**

-   Gives the root user the strongest available second factor
    
-   Root sign-in requires physical access to the hardware device, so the device must be stored securely and its availability planned for emergency access
    
-   Removing the virtual MFA device means it can no longer be used to sign in as the root user
    
-   For member accounts in AWS Organizations with centralized root access enabled, the root credentials can be removed instead, after which the root user is no longer evaluated
    

**Default Value**

A new AWS account's root user has no MFA device assigned. A hardware MFA device must be purchased and registered separately.

**Pre-Requisites**

-   Ability to sign in as the root user (account email address and password)
    
-   A hardware MFA device: a FIDO security key or a hardware TOTP token
    
-   IAM permissions to review the result: iam:GetAccountSummary and iam:ListVirtualMFADevices
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console as the root user.
    
2.  Open the account menu in the top right and choose **Security credentials**.
    
3.  In the **Multi-factor authentication (MFA)** section, review the type of each assigned device.
    
4.  If no MFA device is assigned, or any assigned device is a virtual device (authenticator app), follow the implementation steps.
    

**CLI:**

Show the account summary and check the value of AccountMFAEnabled (1 means MFA is enabled for the root user):

aws iam get-account-summary

Show any virtual MFA device assigned to the root user:

aws iam list-virtual-mfa-devices --assignment-status Assigned --query "VirtualMFADevices\[?User.Arn=='arn:aws:iam::<ACCOUNT\_ID>:root'\].SerialNumber"

The account fails if the root user has a password or an active access key and either AccountMFAEnabled is 0, or a virtual MFA device is assigned to the root user (even if a hardware device is also assigned).

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console as the root user, using the account email address.
    
2.  Open the account menu in the top right and choose **Security credentials**.
    
3.  In the **Multi-factor authentication (MFA)** section, choose **Assign MFA device**.
    
4.  Enter a device name, select **Passkey or security key** or **Hardware TOTP token** and choose **Next**.
    
5.  Follow the prompts to register the device:
    
    -   for a security key, insert or tap the key when asked,
        
    -   for a hardware TOTP token, enter the serial number and two consecutive MFA codes.
        
6.  Choose **Add MFA** (or **Assign MFA**) to finish.
    
7.  Sign out and sign in again as the root user with the new hardware device to confirm it works.
    
8.  In the **Multi-factor authentication (MFA)** section, select each virtual MFA device and choose **Remove**.
    

**Backout Plan**

1.  Sign in to the AWS Management Console as the root user.
    
2.  Open the account menu in the top right and choose **Security credentials**.
    
3.  In the **Multi-factor authentication (MFA)** section, choose **Assign MFA device**, select **Authenticator app** and register the virtual MFA device again.
    
4.  If required, select the hardware device and choose **Remove**.
    

Note: rolling back to a virtual MFA device weakens protection of the root user. Never leave the root user without any MFA device.

**Reference**

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_root-user.html#id\_root-user\_manage\_mfa](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa)
    
-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_mfa\_enable\_fido.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_fido.html)
    
-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_mfa\_enable\_physical.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_physical.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/iam/list-virtual-mfa-devices.html](https://docs.aws.amazon.com/cli/latest/reference/iam/list-virtual-mfa-devices.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.