AWS Organization centrally manages root credentials

​

What this check verifies

AWS Organizations uses centralized root credentials management to control root user credentials across member accounts. This finding evaluates whether the organization has enabled the RootCredentialsManagement feature to centrally govern presence and recovery of root passwords, access keys, signing certificates, and MFA.

​

Risk

Without central control, member accounts can retain or recover long-term root credentials, weakening confidentiality and integrity. Threats include:

• Account takeover via root email recovery
• Persistent access through root keys
• Unfixable lockouts from misconfigured policies
• Bypass of separation of duties

​

Recommendation

Enable centralized root access with root credentials management and assign a delegated administrator. Apply least privilege and separation of duties by deleting long-term root credentials in members, limiting privileged tasks to short-lived sessions, enforcing MFA, and auditing root-related activity for defense in depth.

​

Remediation

​

References

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user-access-management
• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_root_credentials_management_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks