[DEPRECATED] AWS root user has security challenge questions configured
account_security_questions_are_registered_in_the_aws_account
[DEPRECATED] AWS account root configuration may include legacy security challenge questions for support identity verification. This evaluates whether those questions are set on the account. New configuration is discontinued by AWS and remaining support for this feature is time-limited.
Risk
Absence of these questions can limit support-assisted recovery if root credentials or MFA are lost, reducing availability and slowing incident response. Reliance on KBA also weakens confidentiality due to social engineering. Treat this as a recovery gap and adopt stronger, phishing-resistant factors.
prowler aws --checks account_security_questions_are_registered_in_the_aws_account
Recommendation
Favor stronger recovery instead of KBA:
- Enforce MFA for root and minimize root use
- Keep alternate contacts and root email current and protected
- Establish a tightly controlled break-glass role, applying least privilege and separation of duties
- Document and test recovery procedures; monitor root activity
Remediation
- Sign in to the AWS Management Console
- Navigate to your AWS account settings page at https://console.aws.amazon.com/billing/home?#/account/
- Scroll down to Configure Security Challenge Questions section and click the Edit link
- Select three different questions made available by Amazon and provide appropriate answers
- Store the answers in a secure but accessible location
- Click the Update button to save the changes
Source Code
Resource Type
Other