📝 AWS Account Root User credentials were used is the last 30 days 🔴🟢
- Contextual name: 📝 Root User credentials were used is the last 30 days 🔴🟢
- ID:
/ce/ca/aws/iam/root-account-used-recently - Located in: 📁 AWS IAM
Flags
Our Metadata
- Policy Type:
COMPLIANCE_POLICY - Policy Category:
SECURITY
Similar Policies
- Cloud Conformity
- Internal
dec-x-e58fd8e0
Similar Internal Rules
| Rule | Policies | Flags |
|---|---|---|
| ✉️ dec-x-e58fd8e0 | 1 |
Logic
- 🧠 prod.logic.yaml 🟢
TODO 🔴
TODO
Needs additional checks for
access_key_1_last_used_date,access_key_2_last_used_date
Description
Description
Verify that the AWS root account credentials have not been used to access your AWS account in the past 30 days. Root account credentials should not be used for day-to-day operations, including administrative tasks. Instead, assign appropriate permissions to individual IAM users or roles to limit dependency on the root account.
Rationale
The AWS root account has unrestricted access to all resources in the AWS environment. Routine use of the root account increases the risk of accidental or intentional misuse, which could result in data breaches, resource compromise, or loss of account control. By ensuring root user credentials are only used for critical administrative tasks (e.g., billing or account setup), organizations can reduce security risks and adhere to best practices for least-privilege access.
Additionally, frequent root account usage can undermine auditing efforts and make it difficult to track accountability.
Impact
May require additional administrative effort to configure and maintain IAM roles and secure workflows.
... see more
Remediation
Remediation
Ensure all root account usage is necessary, logged, and secured. For any non-critical tasks, use IAM roles or users.
Consider implementing these steps to effectively minimize the use of root account credentials and enhance the security of your AWS account.
From Command Line
Enable MFA for the root account (if not already enabled)
Create the virtual device entity in IAM to represent a virtual MFA device:
aws iam create-virtual-mfa-device \
--virtual-mfa-device-name {{mfa-device-name}} \
--outfile {{filepath}} \
--bootstrap-method {{bootstrap-method}}Enable an MFA device for use with AWS:
aws iam enable-mfa-device \
--user-name root \
--serial-number {{mfa-device-arn}} \
--authentication-code1 123456 \
--authentication-code2 789012Create and use IAM roles for administrative tasks
Define and assign roles with specific permissions instead of relying on root user credentials:
aws iam create-role --role-name {{admin-role}} --assume-role-policy-document file://{{trust-policy}}.json
aws iam attach-role-policy --role-name {{admin-role}} --policy-arn {{arn:aws:iam::aws:policy/admin-access}}
... [see more](remediation.md)