AWS account root user has not been used in the last day

​

What this check verifies

AWS IAM root user activity is assessed by inspecting last-used timestamps for the root password and access keys. The finding indicates when the root identity has been used recently for console or programmatic access.

​

Risk

Recent root usage expands blast radius:

• Data exfiltration (confidentiality)
• Policy/key tampering (integrity)
• Resource deletion and billing changes (availability) Routine use reduces anomaly visibility and eases account takeover impact.

​

Recommendation

Minimize root usage by applying least privilege with admin roles or federated SSO and temporary credentials.

• Enforce MFA on root
• Avoid or remove root access keys
• Require multi-person approval
• Monitor and alert on any root sign-in
• Use org guardrails for defense in depth

​

Remediation

Dashboard steps

1. Sign in to the AWS Management Console as the root user
2. In the top-right, click your account name > Security credentials
3. Under Access keys for the root user, delete all existing keys
4. Sign out of the root user and do not use it again
5. Wait 24 hours (until the root user has not been accessed for a full day) for the check to pass

​

References

• https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html
• https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/IAM/root-account-used-recently.html

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_avoid_root_usage. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks