AWS root user is evaluated for active access keys. It identifies whether the root identity has one or two programmatic credentials and notes when organization-level root credential management is present.
Risk
Root access keys provide unrestricted API access. If exposed or misused, attackers can:
- Turn off logging and alter policies (integrity)
- Read or export data (confidentiality)
- Delete resources and lock out admins (availability) Long-lived keys can persist and may bypass console-only MFA.
Run this check with Prowler CLI
prowler aws --checks iam_no_root_access_key
Recommendation
Delete and prohibit root access keys. Use IAM roles and temporary credentials with least privilege for all automation. Enable MFA on root, limit root to break-glass use, and continuously monitor for any new root keys. Where applicable, apply organization-wide controls to enforce this.
Remediation
Other
- Sign in to the AWS Management Console as the root user
- Open My Security Credentials (account menu) or go to https://console.aws.amazon.com/iam/home?#/security_credentials
- Expand Access keys
- For each key with Status "Active", choose Delete and confirm
- Verify no Active keys remain for the root user
Source Code
Resource Type
AwsIamAccessKey