Root Account Access Keys Should Be Rotated
More Info:
Root account should not have access keys. If at all you have that, then the keys should be rotated periodically.Risk Level
MediumAddress
SecurityCompliance Standards
HIPAA, ISO27001, CISAWS, CBPTriage and Remediation
How to Prevent
Using Console
Using Console
To prevent the issue of root account access keys needing rotation in AWS IAM using the AWS Management Console, follow these steps:
-
Navigate to IAM Dashboard:
- Sign in to the AWS Management Console.
- In the navigation bar, select “Services” and then choose “IAM” to open the IAM Dashboard.
-
Access the Root Account Security Settings:
- In the IAM Dashboard, click on the “Dashboard” link in the left-hand navigation pane.
- Look for the “Security Status” section and click on “Manage Security Credentials” under the “Root Account” heading.
-
Review Access Keys:
- In the “Security Credentials” page, scroll down to the “Access keys” section.
- Check the status and last used date of any existing access keys for the root account.
-
Delete or Disable Root Access Keys:
- If access keys are present, consider deleting or disabling them to prevent their use. Click on the “Delete” button next to each access key to remove it.
- Alternatively, if you need to keep the access keys, ensure they are rotated regularly by setting up a reminder or using an automated tool to manage key rotation.
Using CLI
Using CLI
To prevent the issue of root account access keys not being rotated in AWS IAM using the AWS CLI, you can follow these steps:
-
Create IAM User for Administrative Tasks:
- Instead of using the root account for daily administrative tasks, create an IAM user with administrative privileges.
- Command:
-
Attach Administrative Policies to the IAM User:
- Attach the necessary policies to the IAM user to grant administrative privileges.
- Command:
-
Enable Multi-Factor Authentication (MFA) for the Root Account:
- Ensure that MFA is enabled for the root account to add an extra layer of security.
- Command (Note: This step requires manual intervention to complete the MFA setup):
-
Delete Existing Root Access Keys:
- Remove any existing access keys for the root account to prevent their use.
- Command:
Using Python
Using Python
To prevent the misconfiguration of not rotating root account access keys in IAM using Python scripts, you can follow these steps:
-
Set Up AWS SDK for Python (Boto3):
- Ensure you have the AWS SDK for Python (Boto3) installed. You can install it using pip if you haven’t already:
- Ensure you have the AWS SDK for Python (Boto3) installed. You can install it using pip if you haven’t already:
-
Create a Python Script to Check Root Access Key Age:
- Write a Python script that uses Boto3 to check the age of the root access keys. If the keys are older than a specified threshold (e.g., 90 days), the script can alert you or take action to rotate them.
-
Automate the Script Execution:
- Schedule the script to run periodically (e.g., daily) using a task scheduler like cron (Linux) or Task Scheduler (Windows) to ensure continuous monitoring.
-
Implement Key Rotation Logic (Optional):
- If you want to automate the rotation process, you can extend the script to deactivate the old key and create a new one. Ensure you securely store the new key and update any systems that use it.