> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Access Keys For Root Account

### More Info:

Root account has full permissions across the entire account. Root account should not have access keys. Also, it certainly shouldn''t access any service. Instead, create IAM users with predefined roles.

### Risk Level

High

### Address

Security

### Compliance Standards

PCI, HIPAA, APRA, MAS, NIST

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate “Access Keys for Root Account” in AWS IAM using the AWS Management Console, you should (1) remove the root access keys and (2) ensure you have a proper IAM admin user instead.

        ***

        ## 1. Verify you have an alternative admin user

        Before deleting root access keys, make sure there is at least one IAM user with administrator permissions.

        1. Sign in to the AWS Management Console as **root** (since you’re fixing root keys) or as an existing admin.
        2. Go to **IAM** → **Users**.
        3. If no suitable admin user exists:
           1. Click **Add users**.
           2. Enter a **User name** (e.g., `admin-user`).
           3. Select **Provide user access to the AWS Management Console** and set a console password as desired.
           4. Click **Next**.
           5. Under **Set permissions**, choose:
              * **Attach policies directly** and select **AdministratorAccess**, or
              * **Add user to group** and choose a group that has admin-equivalent permissions.
           6. Complete the wizard (**Next** → **Create user**).
        4. Sign out and sign back in as this **IAM admin user** to confirm you can manage resources.

        ***

        ## 2. Locate and delete root access keys

        You must sign in as the **root user** to manage root access keys.

        1. Sign out of any IAM user session.
        2. Sign in as **root user**:
           * On the sign‑in page, choose **Root user**, enter the **root account email**, then the password.
        3. In the console, open your **Account settings**:
           * Choose your **account name / AWS account ID** (top-right) → **Account**
           * Or go to **My Security Credentials** (sometimes under your account dropdown).
        4. In **My Security Credentials**, scroll to the **Access keys (access key ID and secret access key)** section under the **Root user** heading.
        5. For each existing root access key:
           1. If it is **Active**, select **Make inactive** (if you want a testing period) or go straight to **Delete**.
           2. Confirm deletion when prompted.
        6. Ensure that **no Active or Inactive access keys remain for the root account** (preferably 0 keys total).

        ***

        ## 3. Confirm nothing is using the root keys

        Before or immediately after deletion, check whether anything was still using those keys:

        1. While signed in as root or as an admin IAM user, open **CloudTrail**.
        2. Search for **Event source** = `signin.amazonaws.com` or operations using the root’s access key ID (if known).
        3. Verify that no critical workloads or automation depended on those keys; if something breaks, reconfigure it to use an IAM user or role instead (never root).

        ***

        ## 4. Secure the root account (required best practices)

        1. Still in **My Security Credentials**, set up **MFA**:
           1. Under **Multi-factor authentication (MFA)**, click **Assign MFA device**.
           2. Choose **Authenticator app** or **Security key**, follow the wizard to complete setup.
        2. Verify **Contact Information**, **Alternate Contacts**, and **Security challenge questions** are up to date.

        ***

        ## 5. Use IAM users/roles instead of root

        For anything that was using the root access keys:

        1. Create an appropriate **IAM user** or **IAM role** with least-privilege permissions.
        2. Generate **access keys** for that IAM user (if programmatic access is required):
           * IAM → **Users** → select user → **Security credentials** → **Create access key**.
        3. Update applications / scripts / CI systems to use the new IAM user’s keys or assumed role instead of the root credentials.

        After these steps, the misconfiguration “Access Keys For Root Account” is remediated: the root account has no access keys and is only used for exceptional administrative tasks with MFA.
      </Accordion>

      <Accordion title="Using CLI">
        For the AWS **root** account, the correct remediation is to **delete all root access keys** and stop using them. Root keys should not exist.

        Below are the **AWS CLI steps** to find and delete root access keys.

        ***

        ### 0. Preconditions

        * You must run these commands **authenticated as the root user** (i.e., using the root user’s access key/secret or via a session started with them).
        * Install and configure the CLI:

        ```bash theme={null}
        aws configure
        # enter the root access key, secret key, region, output format
        ```

        ***

        ### 1. List Existing Root Access Keys

        ```bash theme={null}
        aws iam list-access-keys
        ```

        Output example:

        ```json theme={null}
        {
          "AccessKeyMetadata": [
            {
              "UserName": "<root_account>",
              "AccessKeyId": "AKIAxxxxxxxxxxxx1",
              "Status": "Active",
              "CreateDate": "2023-01-01T00:00:00Z"
            },
            {
              "UserName": "<root_account>",
              "AccessKeyId": "AKIAxxxxxxxxxxxx2",
              "Status": "Inactive",
              "CreateDate": "2023-02-01T00:00:00Z"
            }
          ]
        }
        ```

        Collect all `AccessKeyId` values.

        ***

        ### 2. (Optional) First Inactivate the Keys

        This reduces risk before permanent deletion, especially if they’re still in use somewhere:

        ```bash theme={null}
        aws iam update-access-key \
          --access-key-id AKIAxxxxxxxxxxxx1 \
          --status Inactive

        aws iam update-access-key \
          --access-key-id AKIAxxxxxxxxxxxx2 \
          --status Inactive
        ```

        Confirm:

        ```bash theme={null}
        aws iam list-access-keys
        ```

        Ensure `Status` is `Inactive`.

        ***

        ### 3. Delete All Root Access Keys

        Once you’re sure nothing is relying on them:

        ```bash theme={null}
        aws iam delete-access-key \
          --access-key-id AKIAxxxxxxxxxxxx1

        aws iam delete-access-key \
          --access-key-id AKIAxxxxxxxxxxxx2
        ```

        Verify that no keys remain:

        ```bash theme={null}
        aws iam list-access-keys
        # "AccessKeyMetadata": [] should be empty
        ```

        At this point, the root account has **no access keys**.

        ***

        ### 4. Create/Use an Admin IAM Role Instead of Root

        From now on:

        1. Create an IAM admin role (one time, via console or CLI) and use that for administration.
        2. Avoid ever re-creating root access keys.

        ***

        ### 5. Additional Hardening (Recommended, but not CLI-only)

        * Enable **MFA** for the root account (must be done in the console).
        * Ensure root is only used for:
          * Account settings / billing
          * A few rare account-level tasks

        If you want, I can provide the exact CLI policy and commands to create an admin IAM role to replace root usage.
      </Accordion>

      <Accordion title="Using Python">
        You cannot delete or rotate root access keys via the AWS API (including Python/boto3).\
        The API can only *detect* that root access keys exist; the actual deletion must be done in the console while logged in as the root user.

        Below is how to handle this in a Python-based workflow:

        ***

        ## 1. Detect if the root account has access keys (Python/boto3)

        ```python theme={null}
        import boto3

        def root_access_keys_present():
            iam = boto3.client("iam")
            summary = iam.get_account_summary()["SummaryMap"]
            # 1 means at least one access key exists for the root account
            return summary.get("AccountAccessKeysPresent", 0) > 0

        if __name__ == "__main__":
            if root_access_keys_present():
                print("Root access keys are PRESENT — remediation required.")
            else:
                print("No root access keys exist.")
        ```

        You can run this as part of CI/CD or a compliance check, and fail if root keys exist.

        ***

        ## 2. Remediation steps (manual, but enforceable via Python checks)

        1. **Sign in as the root user**
           * Go to [https://signin.aws.amazon.com](https://signin.aws.amazon.com) and log in with the root email address (not an IAM user).
           * Complete MFA if configured.

        2. **Delete the root access keys**
           * In the AWS Management Console, open:\
             `My Security Credentials` → `Access keys (access key ID and secret access key)`
           * For each access key:
             * Deactivate it.
             * Then delete it.

        3. **Verify with Python that keys are gone**

           After you delete them, rerun the Python check:

           ```python theme={null}
           if not root_access_keys_present():
               print("✅ Root access keys successfully removed.")
           ```

        ***

        ## 3. Replace root usage with IAM + roles (Python examples)

        ### 3.1 Create an admin IAM role for human admins

        From the console (once per account):

        1. IAM → Roles → Create role.
        2. Trusted entity: **AWS account** → “This account”.
        3. Attach policy: `AdministratorAccess` (or a restricted custom admin policy).
        4. Name it `OrganizationAdminRole` (for example).

        ### 3.2 Assume the admin role from Python instead of using root

        Use STS to assume the admin role and then perform admin actions:

        ```python theme={null}
        import boto3

        def get_admin_session(role_arn, session_name="admin-session"):
            sts = boto3.client("sts")
            resp = sts.assume_role(
                RoleArn=role_arn,
                RoleSessionName=session_name
            )

            creds = resp["Credentials"]
            return boto3.Session(
                aws_access_key_id=creds["AccessKeyId"],
                aws_secret_access_key=creds["SecretAccessKey"],
                aws_session_token=creds["SessionToken"],
            )

        if __name__ == "__main__":
            role_arn = "arn:aws:iam::123456789012:role/OrganizationAdminRole"
            admin_sess = get_admin_session(role_arn)
            iam = admin_sess.client("iam")
            print(iam.list_users())
        ```

        ***

        ## 4. Enforce this as a policy

        Use the detection script to:

        * Fail CI/CD pipelines when `root_access_keys_present()` is `True`.
        * Periodically scan accounts (e.g., via a Lambda or external compliance tool).
        * Alert via SNS/Slack when root keys are detected.

        That is the most you can do with Python: *detect and enforce via automation*, then delete the keys manually in the console as root.
      </Accordion>

      <Accordion title="Using Terraform">
        Terraform cannot remediate root account access keys because the AWS root user is not an IAM resource and is not exposed via any Terraform-managed API.

        To fix this, you must use the AWS console (or direct AWS CLI) as the root user:

        1. Sign in as the AWS root user.
        2. Go to “My Security Credentials”.
        3. Under “Access keys (access key ID and secret access key)”, deactivate and then delete all access keys for the root account.

        This change is outside Terraform state, so `terraform plan` will show no changes related to this remediation.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

[http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html](http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html)