Root Account Should Not Have Access Keys
More Info:
Root account has full permissions across the entire account. Root account should not have access keys. Also, it certainly shouldn’t access any service. Instead, create IAM users with predefined roles.Risk Level
CriticalAddress
SecurityCompliance Standards
HIPAA, ISO27001, PCIDSS, GDPR, NIST, SOC2, CISAWS, CBP, HITRUST, AWSWAF, NISTCSF, FedRAMPTriage and Remediation
How to Prevent
Using Console
Using Console
To prevent the root account from having access keys in AWS IAM using the AWS Management Console, follow these steps:
-
Sign in to the AWS Management Console:
- Open the AWS Management Console at https://aws.amazon.com/console/.
- Sign in using your root account credentials.
-
Navigate to the IAM Dashboard:
- In the AWS Management Console, click on the “Services” menu at the top of the page.
- Under “Security, Identity, & Compliance,” select “IAM” to open the IAM Dashboard.
-
Access the Root Account Security Settings:
- In the IAM Dashboard, look for the “Security Status” section.
- Click on the “Manage security credentials” link next to the “Root account” label. This will take you to the “Security Credentials” page for the root account.
-
Check and Delete Access Keys:
- On the “Security Credentials” page, scroll down to the “Access keys” section.
- If there are any active access keys listed, click on the “Delete” button next to each key to remove them.
- Confirm the deletion when prompted to ensure that the root account no longer has any access keys.
Using CLI
Using CLI
To prevent the root account from having access keys in AWS IAM using the AWS CLI, you can follow these steps:
-
Check for Existing Access Keys:
First, you need to check if there are any access keys associated with the root account. This can be done by listing the access keys for the root user.
-
Delete Existing Access Keys:
If there are any access keys associated with the root account, you should delete them. Replace
ACCESS_KEY_IDwith the actual access key ID you want to delete. -
Create an IAM User for Administrative Tasks:
Instead of using the root account, create an IAM user with administrative privileges. This user will be used for tasks that require elevated permissions.
-
Enable MFA for Root Account:
To further secure the root account, enable Multi-Factor Authentication (MFA). This step doesn’t directly involve the CLI but is a best practice to ensure the root account is secure.
Using Python
Using Python
To prevent the root account from having access keys in IAM using Python scripts, you can use the AWS SDK for Python (Boto3). Here are the steps to achieve this:
-
Install Boto3:
Ensure you have Boto3 installed in your Python environment. You can install it using pip if you haven’t already:
-
Create a Boto3 Session:
Initialize a Boto3 session with the necessary credentials and region information.
-
Check for Root Access Keys:
Use the IAM client to list access keys for the root account and ensure no access keys exist.
-
Automate the Check and Preventive Action:
You can automate this check to run periodically and alert or take action if access keys are found.