Root account has MFA enabled

​

What this check verifies

AWS root user with active credentials is assessed for MFA activation. The evaluation considers whether the root identity has a password or access keys and whether MFA is enabled. If centralized root access is enabled in Organizations, the presence of individual root credentials is also noted.

​

Risk

Without MFA, compromise of the root password or access keys can lead to full account takeover. An attacker with root can disable protections, steal or delete data, change billing, and create persistent admins, undermining confidentiality, integrity, and availability.

​

Recommendation

Enable MFA for the root user, preferably hardware-based or a dedicated, managed device. Remove root access keys and avoid using root for daily tasks. Apply least privilege with IAM Identity Center for admins, and use Organizations to centralize root access and eliminate long-lived root credentials.

​

Remediation

Dashboard steps

1. Sign in to the AWS Management Console as the root user (choose “Sign in as root user” and enter the account email)
2. Open the account menu (top right) and click “Security credentials”
3. In “Multi-factor authentication (MFA)”, choose “Assign MFA device” (or “Activate MFA”)
4. Select “Authenticator app” and click “Next”
5. Scan the QR code with your authenticator app and enter two consecutive MFA codes
6. Click “Add MFA” (or “Assign MFA”) to complete

​

References

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#id_root-user_manage_mfa

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_root_mfa_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks