lacework-global-34
1.4 Ensure no 'root' user account access key exists (Automated)
Profile Applicability
• Level 1
Description
The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted.
Rationale
Removing access keys associated with the 'root' user account limits vectors by which the account can be compromised. Additionally, removing the 'root' access keys encourages the creation and use of role based accounts that are least privileged.
Audit
Perform the following to determine if the 'root' user account has access keys:
From Console
- Login to the AWS Management Console.
- Click
Services
. - Click
IAM
. - Click on
Credential Report
. - This will download an
.xls
file which contains credential usage for all IAM users within an AWS Account - open this file. - For the
<root_account>
user, ensure theaccess_key_1_active
andaccess_key_2_active
fields are set toFALSE
.
From Command Line
Run the following command:
aws iam get-account-summary | grep "AccountAccessKeysPresent"
If no 'root' access keys exist the output will show "AccountAccessKeysPresent": 0,
.
If the output shows a "1", then 'root' keys exist and should be deleted.
Remediation
Perform the following to delete active 'root' user access keys.
From Console
- Sign in to the AWS Management Console as 'root' and open the IAM console at https://console.aws.amazon.com/iam/.
- Click on
<root_account>
at the top right and selectMy Security Credentials
from the drop down list. - On the pop out screen Click on
Continue to Security Credentials
. - Click on
Access Keys
(Access Key ID and Secret Access Key). - Under the
Status
column (if there are any Keys which are active). - Click
Delete
(Note: Deleted keys cannot be recovered).
Note: While a key can be made inactive, this inactive key will still show up in the CLI command from the audit procedure, and may lead to a key being falsely flagged as being non-compliant.
References
CCE-78910-7
https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html
https://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html
https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html
https://aws.amazon.com/blogs/security/an-easier-way-to-determine-the-presence-of-aws-account-access-keys/
Additional Information
IAM User account "root" for us-gov cloud regions is not enabled by default. However, on request to AWS support enables 'root' access only through access-keys (CLI, API methods) for us-gov cloud region.