# Ensure MFA is enabled for the root account

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292215809102-ensure-mfa-is-enabled-for-the-root-account
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that multi-factor authentication (MFA) is enabled for the AWS account root user. With MFA, signing in as the root user requires both the password and a code or confirmation from a registered MFA device. Only a root user that has a password or an active access key is evaluated.

**Rationale**

The root user has unrestricted access to every resource and setting in the account, including billing and account closure. Without MFA, anyone who obtains the root password or access keys can take over the account, disable security controls, steal or delete data and create persistent administrator access. Enabling MFA, preferably on a hardware device, and avoiding use of the root user for daily tasks greatly reduces this risk.

**Impact**

-   Protects the most privileged identity in the account against password theft and guessing
    
-   Root sign-in requires access to the MFA device, so the device must be stored securely and its availability planned for emergency access
    
-   For member accounts in AWS Organizations with centralized root access enabled, the root credentials can be removed instead, after which the root user is no longer evaluated
    

**Default Value**

A new AWS account's root user has no MFA device until one is registered. AWS may prompt or require the root user to register MFA at sign-in.

**Pre-Requisites**

-   Ability to sign in as the root user (account email address and password)
    
-   An MFA device: a FIDO security key, a hardware TOTP token, or an authenticator app on a dedicated, managed mobile device
    
-   IAM permission to review the result: iam:GetAccountSummary (or iam:GenerateCredentialReport and iam:GetCredentialReport)
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the IAM console and select **Credential report** in the left menu.
    
3.  Download the report and find the row for <root\_account>.
    
4.  If password\_enabled, access\_key\_1\_active or access\_key\_2\_active is true, check the mfa\_active column.
    
5.  If mfa\_active is false, follow the implementation steps.
    

**CLI:**

Show the account summary and check the value of AccountMFAEnabled (1 means MFA is enabled for the root user):

aws iam get-account-summary

The account fails if the root user has a password or an active access key and MFA is not active (mfa\_active is false in the credential report, or AccountMFAEnabled is 0).

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console as the root user, using the account email address.
    
2.  Open the account menu in the top right and choose **Security credentials**.
    
3.  In the **Multi-factor authentication (MFA)** section, choose **Assign MFA device**.
    
4.  Enter a device name, select the device type (**Passkey or security key**, **Authenticator app** or **Hardware TOTP token**) and choose **Next**.
    
5.  Follow the prompts to register the device. For an authenticator app or TOTP token, enter two consecutive MFA codes.
    
6.  Choose **Add MFA** (or **Assign MFA**) to finish.
    

**Backout Plan**

1.  Sign in to the AWS Management Console as the root user.
    
2.  Open the account menu in the top right and choose **Security credentials**.
    
3.  In the **Multi-factor authentication (MFA)** section, select the MFA device and choose **Remove**.
    
4.  Confirm the removal.
    

Note: removing MFA leaves the root user protected only by its password, which exposes the account to full takeover. Do this only to replace a lost or faulty device, and register a new device immediately.

**Reference**

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_root-user.html#id\_root-user\_manage\_mfa](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa)
    
-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html)
    
-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_credentials\_getting-report.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.