Root Account Certificates Should Be Rotated

More Info:

Certificates tied with root accounts needs rotation.

Risk Level

Critical

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Prevention

How to Prevent

Using Console

To prevent the misconfiguration of not rotating root account certificates in AWS IAM using the AWS Management Console, follow these steps:

1. Navigate to IAM Dashboard:

   • Sign in to the AWS Management Console.
   • In the top right corner, click on your account name or number, and then select "My Security Credentials."
   • Alternatively, you can directly go to the IAM Dashboard by searching for "IAM" in the AWS Management Console search bar.

2. Access Security Credentials:

   • On the IAM Dashboard, click on "Users" in the left-hand navigation pane.
   • Select the root account (usually indicated by the account email address).

3. Review and Rotate Certificates:

   • Under the "Security credentials" tab, locate the "X.509 Certificates" section.
   • Review the existing certificates and their expiration dates.
   • If a certificate is nearing expiration or has been in use for an extended period, generate a new certificate by clicking on "Manage X.509 Certificates" and then "Create Certificate."

4. Implement a Rotation Policy:

   • Establish a regular schedule for rotating root account certificates, such as every 90 days.
   • Document the rotation process and ensure that it is followed consistently.
   • Use AWS CloudWatch or AWS Config to set up alerts and notifications for certificate expiration dates to ensure timely rotation.

By following these steps, you can ensure that root account certificates are regularly rotated, reducing the risk of security vulnerabilities associated with outdated or compromised certificates.

Using CLI

To prevent the issue of root account certificates needing rotation in AWS IAM using the AWS CLI, you can follow these steps:

1. Create a New Access Key for the Root Account:

   • First, create a new access key for the root account. This should be done to ensure that you have a new set of credentials before deleting the old ones.

   aws iam create-access-key --user-name <root-account-username>

2. List Existing Access Keys:

   • List all the access keys associated with the root account to identify the old keys that need to be rotated.

   aws iam list-access-keys --user-name <root-account-username>

3. Delete the Old Access Key:

   • After ensuring that the new access key is working correctly, delete the old access key to complete the rotation process.

   aws iam delete-access-key --user-name <root-account-username> --access-key-id <old-access-key-id>

4. Enable MFA for Root Account:

   • To add an additional layer of security, enable Multi-Factor Authentication (MFA) for the root account. This can be done by associating an MFA device with the root account.

   aws iam create-virtual-mfa-device --virtual-mfa-device-name <device-name>
   aws iam enable-mfa-device --user-name <root-account-username> --serial-number <device-arn> --authentication-code-1 <code-1> --authentication-code-2 <code-2>

By following these steps, you can ensure that the root account certificates are rotated regularly, thereby enhancing the security of your AWS environment.

Using Python

To prevent the misconfiguration of not rotating root account certificates in IAM using Python scripts, you can follow these steps:

1. Set Up AWS SDK (Boto3) for Python:

   • First, ensure you have the AWS SDK for Python (Boto3) installed. You can install it using pip if you haven't already:

     pip install boto3

2. Create a Python Script to Check Certificate Age:

   • Write a Python script that checks the age of the root account certificates. If the certificates are older than a specified threshold (e.g., 90 days), the script should trigger an alert or take action to rotate them.

   import boto3
   from datetime import datetime, timedelta
   
   # Initialize a session using Amazon IAM
   session = boto3.Session(profile_name='your_profile_name')
   iam_client = session.client('iam')
   
   # Define the threshold for certificate age (e.g., 90 days)
   threshold_days = 90
   threshold_date = datetime.now() - timedelta(days=threshold_days)
   
   # List the server certificates
   response = iam_client.list_server_certificates()
   
   for cert in response['ServerCertificateMetadataList']:
       cert_name = cert['ServerCertificateName']
       cert_upload_date = cert['UploadDate']
   
       # Check if the certificate is older than the threshold
       if cert_upload_date < threshold_date:
           print(f"Certificate {cert_name} is older than {threshold_days} days and should be rotated.")
           # Here you can add code to trigger an alert or initiate the rotation process

3. Automate the Script Execution:

   • Schedule the script to run at regular intervals (e.g., daily) using a task scheduler like cron (Linux) or Task Scheduler (Windows). This ensures continuous monitoring and timely alerts.

   Example cron job to run the script daily at midnight:

   0 0 * * * /usr/bin/python3 /path/to/your_script.py

4. Integrate with Notification System:

   • Enhance the script to send notifications (e.g., via email, Slack, or AWS SNS) when a certificate is due for rotation. This ensures that the responsible team is promptly informed.

   Example of sending an email notification using AWS SNS:

   import boto3
   from datetime import datetime, timedelta
   
   # Initialize a session using Amazon IAM
   session = boto3.Session(profile_name='your_profile_name')
   iam_client = session.client('iam')
   sns_client = session.client('sns')
   
   # Define the threshold for certificate age (e.g., 90 days)
   threshold_days = 90
   threshold_date = datetime.now() - timedelta(days=threshold_days)
   
   # List the server certificates
   response = iam_client.list_server_certificates()
   
   for cert in response['ServerCertificateMetadataList']:
       cert_name = cert['ServerCertificateName']
       cert_upload_date = cert['UploadDate']
   
       # Check if the certificate is older than the threshold
       if cert_upload_date < threshold_date:
           message = f"Certificate {cert_name} is older than {threshold_days} days and should be rotated."
           print(message)
           # Send notification
           sns_client.publish(
               TopicArn='arn:aws:sns:your-region:your-account-id:your-topic',
               Message=message,
               Subject='IAM Certificate Rotation Alert'
           )

By following these steps, you can effectively prevent the misconfiguration of not rotating root account certificates in IAM using Python scripts.

Cause

Check Cause

Using Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

2. In the navigation pane, choose "Users". This will display a list of all IAM users associated with the account.

3. Click on the user name of the root account. This will open the summary page for the root account.

4. In the "Security Credentials" section, check the "Access Keys" list. If there are any access keys that are older than 90 days, it indicates that the root account certificates have not been rotated.

Using CLI

1. First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access IAM resources.

2. Once the AWS CLI is set up, you can use the following command to list all the IAM users in your AWS account:

   aws iam list-users

3. After getting the list of IAM users, you can use the following command to list the signing certificates of each user:

   aws iam list-signing-certificates --user-name <username>

   Replace <username> with the name of the IAM user. This command will return a list of the signing certificates associated with the specified IAM user.

4. To check the age of each certificate, look at the UploadDate field in the output of the previous command. If the certificate is older than a certain threshold (for example, 90 days), it should be considered for rotation.

Using Python

1. First, you need to install the AWS SDK for Python (Boto3) if you haven't done so already. You can install it using pip:

pip install boto3

2. Import the necessary modules and create a session using your AWS credentials:

import boto3

session = boto3.Session(
    aws_access_key_id='YOUR_ACCESS_KEY',
    aws_secret_access_key='YOUR_SECRET_KEY',
    aws_session_token='SESSION_TOKEN',
)

3. Now, you can use the IAM client to list all the server certificates:

iam = session.client('iam')

certificates = iam.list_server_certificates()['ServerCertificateMetadataList']

4. Finally, you can iterate over the certificates and check the expiration date. If the certificate is close to its expiration date, it should be rotated:

from datetime import datetime, timedelta

for certificate in certificates:
    expiration_date = certificate['Expiration']
    if expiration_date - datetime.now() < timedelta(days=30):  # 30 days before expiration
        print(f"Certificate {certificate['ServerCertificateName']} should be rotated")

This script will print the names of all certificates that should be rotated because they will expire in less than 30 days. You can adjust the number of days according to your needs.

Remediation

Remediation

Using Console

1. Sign in to the AWS Management Console.
2. Navigate to the IAM service.
3. Select Server Certificates from the navigation pane.
4. Identify the server certificates:
   • Look for server certificates associated with the root user.
5. Review Certificate Details:
   • Click on the certificate.
   • Review the certificate details, including the upload date.
6. Rotate Certificates:
   • If a certificate has exceeded the minimum rotation threshold, rotate it using the appropriate method.
7. Repeat for other certificates:
   • Repeat the above steps for all certificates associated with the root user.

Using CLI

1. List Server Certificates:

aws iam list-server-certificates

2. Identify Certificates for the Root User:
   • Look for certificates associated with the root user based on the certificate path.
3. Rotate Certificates:
   • Rotate the certificates that have exceeded the minimum rotation threshold using the appropriate method.
4. Repeat for other certificates:
   • If there are multiple certificates associated with the root user, repeat the rotation process for each of them.

Using Python

Here's a Python script to identify and remediate server certificates that have exceeded the minimum rotation threshold for the root user:

import boto3
from datetime import datetime, timedelta

class CertificateRotationChecker:
    def __init__(self):
        self.iam_client = boto3.client('iam')

    def get_certificates_for_root(self):
        root_certificates = []
        response = self.iam_client.list_server_certificates()
        for certificate in response['ServerCertificateMetadataList']:
            if certificate['Path'] == '/':
                root_certificates.append(certificate)
        return root_certificates

    def rotate_certificate(self, certificate_name):
        self.iam_client.update_server_certificate(
            ServerCertificateName=certificate_name,
            NewServerCertificateName=f"{certificate_name}-rotated"
        )
        print(f"Certificate {certificate_name} has been rotated.")

# Instantiate the class
checker = CertificateRotationChecker()

# Get certificates for root user
root_certificates = checker.get_certificates_for_root()

# Define minimum rotation days
minimum_rotation_days = 90  # Example value, adjust as necessary

# Rotate certificates that exceed the minimum rotation threshold
for certificate in root_certificates:
    upload_date = certificate['UploadDate']
    rotation_threshold = datetime.now() - timedelta(days=minimum_rotation_days)
    if upload_date < rotation_threshold:
        checker.rotate_certificate(certificate['ServerCertificateName'])

This Python script identifies server certificates associated with the root user and rotates them if they have exceeded the minimum rotation threshold.

Ensure to have appropriate IAM permissions for managing server certificates if you're using AWS CLI or Python script. Adjust the minimum_rotation_days variable according to your organization's policy.

Using Terraform

Terraform cannot rotate or delete AWS root account access keys or X.509 signing certificates; the root principal is not represented as an aws_iam_user resource and is not manageable via the AWS provider.

You must perform the remediation manually using the AWS Console or CLI as root, following the steps you already listed (create new access key/certificate if absolutely required, update all consumers, then deactivate and delete the old one — or preferably delete all root access keys/certificates and use an IAM administrator user instead). After that, run terraform plan to confirm there are no Terraform changes related to this, since it is entirely out-of-band.

Additional Reading:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html