Access Keys For Root Account

Using Console

To remediate “Access Keys for Root Account” in AWS IAM using the AWS Management Console, you should (1) remove the root access keys and (2) ensure you have a proper IAM admin user instead.

1. Verify you have an alternative admin user

Before deleting root access keys, make sure there is at least one IAM user with administrator permissions.

Sign in to the AWS Management Console as root (since you’re fixing root keys) or as an existing admin.
Go to IAM → Users.
If no suitable admin user exists:
1. Click Add users.
2. Enter a User name (e.g., admin-user).
3. Select Provide user access to the AWS Management Console and set a console password as desired.
4. Click Next.
5. Under Set permissions, choose:
  - Attach policies directly and select AdministratorAccess, or
  - Add user to group and choose a group that has admin-equivalent permissions.
6. Complete the wizard (Next → Create user).
Sign out and sign back in as this IAM admin user to confirm you can manage resources.

2. Locate and delete root access keys

You must sign in as the root user to manage root access keys.

Sign out of any IAM user session.
Sign in as root user:
- On the sign‑in page, choose Root user, enter the root account email, then the password.
In the console, open your Account settings:
- Choose your account name / AWS account ID (top-right) → Account
- Or go to My Security Credentials (sometimes under your account dropdown).
In My Security Credentials, scroll to the Access keys (access key ID and secret access key) section under the Root user heading.
For each existing root access key:
1. If it is Active, select Make inactive (if you want a testing period) or go straight to Delete.
2. Confirm deletion when prompted.
Ensure that no Active or Inactive access keys remain for the root account (preferably 0 keys total).

3. Confirm nothing is using the root keys

Before or immediately after deletion, check whether anything was still using those keys:

While signed in as root or as an admin IAM user, open CloudTrail.
Search for Event source = signin.amazonaws.com or operations using the root’s access key ID (if known).
Verify that no critical workloads or automation depended on those keys; if something breaks, reconfigure it to use an IAM user or role instead (never root).

4. Secure the root account (required best practices)

Still in My Security Credentials, set up MFA:
1. Under Multi-factor authentication (MFA), click Assign MFA device.
2. Choose Authenticator app or Security key, follow the wizard to complete setup.
Verify Contact Information, Alternate Contacts, and Security challenge questions are up to date.

5. Use IAM users/roles instead of root

For anything that was using the root access keys:

Create an appropriate IAM user or IAM role with least-privilege permissions.
Generate access keys for that IAM user (if programmatic access is required):
- IAM → Users → select user → Security credentials → Create access key.
Update applications / scripts / CI systems to use the new IAM user’s keys or assumed role instead of the root credentials.

After these steps, the misconfiguration “Access Keys For Root Account” is remediated: the root account has no access keys and is only used for exceptional administrative tasks with MFA.

Using CLI

For the AWS root account, the correct remediation is to delete all root access keys and stop using them. Root keys should not exist.Below are the AWS CLI steps to find and delete root access keys.

0. Preconditions

You must run these commands authenticated as the root user (i.e., using the root user’s access key/secret or via a session started with them).
Install and configure the CLI:

aws configure
# enter the root access key, secret key, region, output format

1. List Existing Root Access Keys

aws iam list-access-keys

Output example:

{
  "AccessKeyMetadata": [
    {
      "UserName": "<root_account>",
      "AccessKeyId": "AKIAxxxxxxxxxxxx1",
      "Status": "Active",
      "CreateDate": "2023-01-01T00:00:00Z"
    },
    {
      "UserName": "<root_account>",
      "AccessKeyId": "AKIAxxxxxxxxxxxx2",
      "Status": "Inactive",
      "CreateDate": "2023-02-01T00:00:00Z"
    }
  ]
}

Collect all AccessKeyId values.

2. (Optional) First Inactivate the Keys

This reduces risk before permanent deletion, especially if they’re still in use somewhere:

aws iam update-access-key \
  --access-key-id AKIAxxxxxxxxxxxx1 \
  --status Inactive

aws iam update-access-key \
  --access-key-id AKIAxxxxxxxxxxxx2 \
  --status Inactive

Confirm:

aws iam list-access-keys

Ensure Status is Inactive.

3. Delete All Root Access Keys

Once you’re sure nothing is relying on them:

aws iam delete-access-key \
  --access-key-id AKIAxxxxxxxxxxxx1

aws iam delete-access-key \
  --access-key-id AKIAxxxxxxxxxxxx2

Verify that no keys remain:

aws iam list-access-keys
# "AccessKeyMetadata": [] should be empty

At this point, the root account has no access keys.

4. Create/Use an Admin IAM Role Instead of Root

From now on:

Create an IAM admin role (one time, via console or CLI) and use that for administration.
Avoid ever re-creating root access keys.

5. Additional Hardening (Recommended, but not CLI-only)

Enable MFA for the root account (must be done in the console).
Ensure root is only used for:
- Account settings / billing
- A few rare account-level tasks

If you want, I can provide the exact CLI policy and commands to create an admin IAM role to replace root usage.

Using Python

You cannot delete or rotate root access keys via the AWS API (including Python/boto3).
The API can only detect that root access keys exist; the actual deletion must be done in the console while logged in as the root user.Below is how to handle this in a Python-based workflow:

1. Detect if the root account has access keys (Python/boto3)

import boto3

def root_access_keys_present():
    iam = boto3.client("iam")
    summary = iam.get_account_summary()["SummaryMap"]
    # 1 means at least one access key exists for the root account
    return summary.get("AccountAccessKeysPresent", 0) > 0

if __name__ == "__main__":
    if root_access_keys_present():
        print("Root access keys are PRESENT — remediation required.")
    else:
        print("No root access keys exist.")

You can run this as part of CI/CD or a compliance check, and fail if root keys exist.

2. Remediation steps (manual, but enforceable via Python checks)

Sign in as the root user
- Go to https://signin.aws.amazon.com and log in with the root email address (not an IAM user).
- Complete MFA if configured.
Delete the root access keys
- In the AWS Management Console, open:
  My Security Credentials → Access keys (access key ID and secret access key)
- For each access key:
  - Deactivate it.
  - Then delete it.

Verify with Python that keys are gone After you delete them, rerun the Python check:

if not root_access_keys_present():
    print("✅ Root access keys successfully removed.")

3. Replace root usage with IAM + roles (Python examples)

3.1 Create an admin IAM role for human admins

From the console (once per account):

IAM → Roles → Create role.
Trusted entity: AWS account → “This account”.
Attach policy: AdministratorAccess (or a restricted custom admin policy).
Name it OrganizationAdminRole (for example).

3.2 Assume the admin role from Python instead of using root

Use STS to assume the admin role and then perform admin actions:

import boto3

def get_admin_session(role_arn, session_name="admin-session"):
    sts = boto3.client("sts")
    resp = sts.assume_role(
        RoleArn=role_arn,
        RoleSessionName=session_name
    )

    creds = resp["Credentials"]
    return boto3.Session(
        aws_access_key_id=creds["AccessKeyId"],
        aws_secret_access_key=creds["SecretAccessKey"],
        aws_session_token=creds["SessionToken"],
    )

if __name__ == "__main__":
    role_arn = "arn:aws:iam::123456789012:role/OrganizationAdminRole"
    admin_sess = get_admin_session(role_arn)
    iam = admin_sess.client("iam")
    print(iam.list_users())

4. Enforce this as a policy

Use the detection script to:

Fail CI/CD pipelines when root_access_keys_present() is True.
Periodically scan accounts (e.g., via a Lambda or external compliance tool).
Alert via SNS/Slack when root keys are detected.

That is the most you can do with Python: detect and enforce via automation, then delete the keys manually in the console as root.

Using Terraform

Terraform cannot remediate root account access keys because the AWS root user is not an IAM resource and is not exposed via any Terraform-managed API.To fix this, you must use the AWS console (or direct AWS CLI) as the root user:

Sign in as the AWS root user.
Go to “My Security Credentials”.
Under “Access keys (access key ID and secret access key)”, deactivate and then delete all access keys for the root account.

This change is outside Terraform state, so terraform plan will show no changes related to this remediation.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Access Keys For Root Account

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Verify you have an alternative admin user

2. Locate and delete root access keys

3. Confirm nothing is using the root keys

4. Secure the root account (required best practices)

5. Use IAM users/roles instead of root

0. Preconditions

1. List Existing Root Access Keys

2. (Optional) First Inactivate the Keys

3. Delete All Root Access Keys

4. Create/Use an Admin IAM Role Instead of Root

5. Additional Hardening (Recommended, but not CLI-only)

1. Detect if the root account has access keys (Python/boto3)

2. Remediation steps (manual, but enforceable via Python checks)

3. Replace root usage with IAM + roles (Python examples)

3.1 Create an admin IAM role for human admins

3.2 Assume the admin role from Python instead of using root

4. Enforce this as a policy

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Verify you have an alternative admin user

​2. Locate and delete root access keys

​3. Confirm nothing is using the root keys

​4. Secure the root account (required best practices)

​5. Use IAM users/roles instead of root

​0. Preconditions

​1. List Existing Root Access Keys

​2. (Optional) First Inactivate the Keys

​3. Delete All Root Access Keys

​4. Create/Use an Admin IAM Role Instead of Root

​5. Additional Hardening (Recommended, but not CLI-only)

​1. Detect if the root account has access keys (Python/boto3)

​2. Remediation steps (manual, but enforceable via Python checks)

​3. Replace root usage with IAM + roles (Python examples)

​3.1 Create an admin IAM role for human admins

​3.2 Assume the admin role from Python instead of using root

​4. Enforce this as a policy

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Verify you have an alternative admin user

2. Locate and delete root access keys

3. Confirm nothing is using the root keys

4. Secure the root account (required best practices)

5. Use IAM users/roles instead of root

0. Preconditions

1. List Existing Root Access Keys

2. (Optional) First Inactivate the Keys

3. Delete All Root Access Keys

4. Create/Use an Admin IAM Role Instead of Root

5. Additional Hardening (Recommended, but not CLI-only)

1. Detect if the root account has access keys (Python/boto3)

2. Remediation steps (manual, but enforceable via Python checks)

3. Replace root usage with IAM + roles (Python examples)

3.1 Create an admin IAM role for human admins

3.2 Assume the admin role from Python instead of using root

4. Enforce this as a policy

Additional Reading: