Root account has no active access keys

​

What this check verifies

AWS root user is evaluated for active access keys. It identifies whether the root identity has one or two programmatic credentials and notes when organization-level root credential management is present.

​

Risk

Root access keys provide unrestricted API access. If exposed or misused, attackers can:

• Turn off logging and alter policies (integrity)
• Read or export data (confidentiality)
• Delete resources and lock out admins (availability) Long-lived keys can persist and may bypass console-only MFA.

​

Recommendation

Delete and prohibit root access keys. Use IAM roles and temporary credentials with least privilege for all automation. Enable MFA on root, limit root to break-glass use, and continuously monitor for any new root keys. Where applicable, apply organization-wide controls to enforce this.

​

Remediation

Dashboard steps

1. Sign in to the AWS Management Console as the root user
2. Open My Security Credentials (account menu) or go to https://console.aws.amazon.com/iam/home?#/security_credentials
3. Expand Access keys
4. For each key with Status “Active”, choose Delete and confirm
5. Verify no Active keys remain for the root user

​

References

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html
• https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/IAM/root-account-access-keys-present.html

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_no_root_access_key. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks