Cis AWS Foundations 2.4

Ensure no 'root' user account access key exists

Description

The 'root' user account is the most privileged user in an AWS account. AWS access keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted.

Rationale

Deleting access keys associated with the 'root' user account limits the vectors by which the account can be compromised. Additionally, removing 'root' access keys encourages the use of role-based access with least privilege.

Impact

Root access keys significantly increase the risk of account compromise, as they provide unrestricted programmatic access with no built-in scope limitations.

Audit Procedure

Using AWS Console

1. Login to the IAM Management Console (https://console.aws.amazon.com/iam).
2. Click on Credential Report.
3. Download the .csv file which contains credential usage for all IAM users within an AWS Account.
4. Open the file.
5. For the root user, ensure the access_key_1_active and access_key_2_active fields are set to FALSE.

Using AWS CLI

1. Run the following command:

aws iam get-account-summary | grep "AccountAccessKeysPresent"

2. If no 'root' access keys exist the output will show "AccountAccessKeysPresent": 0,
3. If the output shows a "1", then 'root' keys exist and should be deleted.

Expected Result

"AccountAccessKeysPresent": 0 -- no root access keys exist.

Remediation

Using AWS Console

1. Sign in to the AWS Management Console as 'root' and open the IAM console at https://console.aws.amazon.com/iam/.
2. Click on <root_account> at the top right and select Security Credentials from the drop down list.
3. Click on Access Keys (Access Key ID and Secret Access Key).
4. If there are active keys:
   • Deactivate the key under Status.
   • Click Delete (Deleted keys cannot be recovered).

Note: While a key can be made inactive, it will still appear in CLI audit output and may result in a false positive. Keys should be deleted to ensure compliance.

Using AWS CLI

There is no AWS CLI command to delete root access keys. This must be done via the AWS Console.

Default Value

By default, the AWS root user has no access keys created. Access keys are only present if they have been explicitly generated by the account owner.

References

1. http://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html
2. http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html
3. http://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html
4. CCE-78910-7
5. https://aws.amazon.com/blogs/security/an-easier-way-to-determine-the-presence-of-aws-account-access-keys/

Additional Information

• In AWS GovCloud environments, root access is linked to the associated standard AWS account and should be restricted and monitored in the same manner as commercial AWS accounts.
• Implement regular checks and alerts for any creation or use of root credentials, including access keys and console logins, to promptly detect and respond to unauthorized or accidental activity.
• CloudTrail must be enabled and configured to capture activity across all regions and accounts (using a multi-region or organization trail) to ensure all root account activity is logged and monitored.

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated