Description

Ensure that multi-factor authentication (MFA) is enabled for the AWS account root user. With MFA, signing in as the root user requires both the password and a code or confirmation from a registered MFA device. Only a root user that has a password or an active access key is evaluated.

Rationale

The root user has unrestricted access to every resource and setting in the account, including billing and account closure. Without MFA, anyone who obtains the root password or access keys can take over the account, disable security controls, steal or delete data and create persistent administrator access. Enabling MFA, preferably on a hardware device, and avoiding use of the root user for daily tasks greatly reduces this risk.

Impact

  • Protects the most privileged identity in the account against password theft and guessing

  • Root sign-in requires access to the MFA device, so the device must be stored securely and its availability planned for emergency access

  • For member accounts in AWS Organizations with centralized root access enabled, the root credentials can be removed instead, after which the root user is no longer evaluated

Default Value

A new AWS account's root user has no MFA device until one is registered. AWS may prompt or require the root user to register MFA at sign-in.

Pre-Requisites

  • Ability to sign in as the root user (account email address and password)

  • An MFA device: a FIDO security key, a hardware TOTP token, or an authenticator app on a dedicated, managed mobile device

  • IAM permission to review the result: iam:GetAccountSummary (or iam:GenerateCredentialReport and iam:GetCredentialReport)

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Credential report in the left menu.

  3. Download the report and find the row for <root_account>.

  4. If password_enabled, access_key_1_active or access_key_2_active is true, check the mfa_active column.

  5. If mfa_active is false, follow the implementation steps.

CLI:

Show the account summary and check the value of AccountMFAEnabled (1 means MFA is enabled for the root user):

aws iam get-account-summary

The account fails if the root user has a password or an active access key and MFA is not active (mfa_active is false in the credential report, or AccountMFAEnabled is 0).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console as the root user, using the account email address.

  2. Open the account menu in the top right and choose Security credentials.

  3. In the Multi-factor authentication (MFA) section, choose Assign MFA device.

  4. Enter a device name, select the device type (Passkey or security key, Authenticator app or Hardware TOTP token) and choose Next.

  5. Follow the prompts to register the device. For an authenticator app or TOTP token, enter two consecutive MFA codes.

  6. Choose Add MFA (or Assign MFA) to finish.

Backout Plan

  1. Sign in to the AWS Management Console as the root user.

  2. Open the account menu in the top right and choose Security credentials.

  3. In the Multi-factor authentication (MFA) section, select the MFA device and choose Remove.

  4. Confirm the removal.

Note: removing MFA leaves the root user protected only by its password, which exposes the account to full takeover. Do this only to replace a lost or faulty device, and register a new device immediately.

Reference