AWS root user with active credentials is assessed for MFA activation. The evaluation considers whether the root identity has a password or access keys and whether MFA is enabled.
If centralized root access is enabled in Organizations, the presence of individual root credentials is also noted.
Risk
Without MFA, compromise of the root password or access keys can lead to full account takeover. An attacker with root can disable protections, steal or delete data, change billing, and create persistent admins, undermining confidentiality, integrity, and availability.
prowler aws --checks iam_root_mfa_enabled
Recommendation
Enable MFA for the root user, preferably hardware-based or a dedicated, managed device. Remove root access keys and avoid using root for daily tasks. Apply least privilege with IAM Identity Center for admins, and use Organizations to centralize root access and eliminate long-lived root credentials.
Remediation
- Sign in to the AWS Management Console as the root user (choose "Sign in as root user" and enter the account email)
- Open the account menu (top right) and click "Security credentials"
- In "Multi-factor authentication (MFA)", choose "Assign MFA device" (or "Activate MFA")
- Select "Authenticator app" and click "Next"
- Scan the QR code with your authenticator app and enter two consecutive MFA codes
- Click "Add MFA" (or "Assign MFA") to complete
Source Code
Resource Type
AwsIamUser