How to secure the AWS root user: MFA, no access keys, and alerts

Why root is different

The root user is the email address that created the account. It has full access that IAM policies cannot restrict within the account, and a few tasks require it, such as changing the account’s email or closing the account. If someone takes over root, they own the account, including its billing.

The goal is to use root almost never and to notice instantly when it is used.

The checklist

Enable MFA on root, preferably a FIDO2 security key, and register a second key stored safely. Delete any root access keys. Use a group email address that several trusted people can access, not one person’s mailbox. Set alternate contacts for billing, operations, and security. For AWS Organizations, centralized root access management lets you remove root credentials from member accounts entirely.

The IAM credential report shows whether root has MFA and access keys.

Snippet

aws iam get-account-summary --query 'SummaryMap.{RootMFA:AccountMFAEnabled,RootKeys:AccountAccessKeysPresent}'
aws iam generate-credential-report >/dev/null; sleep 5
aws iam get-credential-report --query Content --output text | base64 -d | head -2

Lab: alert on root use

Create an EventBridge rule that matches CloudTrail events where userIdentity.type is Root and sends them to an SNS topic subscribed by email. Sign in as root in a sandbox account and confirm the alert arrives within a few minutes.

Every alert should be explainable by a planned task. Anything else is an incident.

Snippet

{
  "detail-type": ["AWS Console Sign In via CloudTrail", "AWS API Call via CloudTrail"],
  "detail": { "userIdentity": { "type": ["Root"] } }
}

aws events put-rule --name root-activity --event-pattern file://root-pattern.json
aws events put-targets --rule root-activity --targets Id=1,Arn=arn:aws:sns:us-east-1:111122223333:security-alerts

Plan recovery

Document how to recover root if MFA devices are lost: AWS account recovery requires access to the root email and phone number. Keep those current.

Avoid using root to create IAM users for daily work. Use IAM Identity Center or federated roles for people.

Diagram

Root user lockdown

MFA
Two hardware security keys registered.
Keys
Delete any root access keys.
Contacts
Group email and alternate contacts.
Alert
EventBridge rule on userIdentity.type Root.

Check yourself

1. Why is the root user especially sensitive?

2. What should you do with root access keys?

3. Which CloudTrail field identifies root activity?