Root account has a hardware MFA device enabled

​

What this check verifies

AWS root user credentials are assessed for MFA status and device type. The check detects whether MFA is absent or implemented with a virtual device instead of hardware MFA on the root user, and notes when centralized root credential management is in effect.

​

Risk

Without hardware MFA on the root user:

• No MFA: stolen password/keys enable full account takeover.
• Virtual MFA: device compromise or backup restoration weakens second-factor assurance. An attacker could delete resources, change policies, and disable logging, harming confidentiality, integrity, and availability.

​

Recommendation

Require a hardware MFA token for the root user and remove any virtual MFA. Apply least privilege: avoid using root, disable access keys, and eliminate long-term credentials. In organizations, centralize root management. Keep a controlled break-glass process with strict recovery checks and continuous monitoring.

​

Remediation

Dashboard steps

1. Sign in to the AWS Management Console as the root user
2. Open My Security Credentials: https://console.aws.amazon.com/iam/home?#/security_credentials
3. In the Multi-factor authentication (MFA) section, choose Activate/Assign MFA
4. Select a hardware option (Security key or Hardware TOTP token) and complete the prompts (for TOTP: enter the device serial and two consecutive codes)
5. After the hardware MFA is added, locate any Virtual MFA device listed for root and Deactivate/Remove it
6. Confirm only the hardware MFA remains assigned

​

References

• https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/IAM/root-hardware-mfa.html
• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_root_hardware_mfa_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks