Check ID: account_security_questions_are_registered_in_the_aws_account
Provider: AWS
Service: account
Severity: MEDIUM
Resource type: Other

​
What this check verifies

[DEPRECATED] AWS account root configuration may include legacy security challenge questions for support identity verification. This evaluates whether those questions are set on the account. New configuration is discontinued by AWS and remaining support for this feature is time-limited.

​
Risk

Absence of these questions can limit support-assisted recovery if root credentials or MFA are lost, reducing availability and slowing incident response. Reliance on KBA also weakens confidentiality due to social engineering. Treat this as a recovery gap and adopt stronger, phishing-resistant factors.

​
Recommendation

Favor stronger recovery instead of KBA:
  • Enforce MFA for root and minimize root use
  • Keep alternate contacts and root email current and protected
  • Establish a tightly controlled break-glass role, applying least privilege and separation of duties
  • Document and test recovery procedures; monitor root activity

​
Remediation

Dashboard steps
  1. Sign in to the AWS Management Console
  2. Navigate to your AWS account settings page at https://console.aws.amazon.com/billing/home?#/account/
  3. Scroll down to Configure Security Challenge Questions section and click the Edit link
  4. Select three different questions made available by Amazon and provide appropriate answers
  5. Store the answers in a secure but accessible location
  6. Click the Update button to save the changes

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = account_security_questions_are_registered_in_the_aws_account. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks