Skip to main content

lacework-global-34

1.4 Ensure no 'root' user account access key exists (Automated)​

Profile Applicability​

• Level 1

Description​

The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. Best practices recommend deleting all access keys associated with the 'root' user account.

Rationale​

Removing access keys associated with the 'root' user account limits vectors by which the account can be compromised. Additionally, removing the 'root' access keys encourages the creation and use of role based accounts that are least privileged.

Audit​

Perform the following to determine if the 'root' user account has access keys:

From Console​

  1. Login to the AWS Management Console.
  2. Click Services.
  3. Click IAM.
  4. Click on Credential Report.
  5. This will download an .xls file which contains credential usage for all IAM users within an AWS Account - open this file.
  6. For the <root_account> user, ensure the access_key_1_active and access_key_2_active fields are set to FALSE.

From Command Line​

Run the following command:

aws iam get-account-summary | grep "AccountAccessKeysPresent"

If no 'root' access keys exist the output will show "AccountAccessKeysPresent": 0,.

If the output shows a "1", then 'root' keys exist and should be deleted.

Remediation​

Perform the following to delete active 'root' user access keys:

From Console​

  1. Sign in to the AWS Management Console as 'root' and open the Identity and Access Management (IAM) console at https://console.aws.amazon.com/iam/.
  2. Click <root_account> at the top right and select Security Credentials from the drop down list.
  3. On the pop out screen, click Continue to Security Credentials.
  4. Click Access Keys (Access Key ID and Secret Access Key).
  5. Under the Status column (if there are any Keys which are active).
  6. Click Delete (Note: It is not possible to recover deleted keys).

Note: Inactive keys still show up if queried via the CLI, which may lead to a key being falsely flagged as being non-compliant.

References​

CCE-78910-7
https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html
https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html
https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html
https://aws.amazon.com/blogs/security/an-easier-way-to-determine-the-presence-of-aws-account-access-keys/

Additional Information​

IAM User account "root" for us-gov cloud regions is not enabled by default. However, on request to AWS support enables 'root' access only through access-keys (CLI, API methods) for us-gov cloud region.

Last updated on