Secure account root user and properties

The root user holds the highest level of privilege in an AWS account, with unrestricted access to all resources. To minimize the risk of credential exposure or misuse, it’s critical to disable programmatic access, enforce strong controls, and avoid the routine use of the root account.

1. Disable programmatic access for root: Remove access keys associated with the root user to prevent any API-based interactions. Root access should only be used for essential tasks, and never in day-to-day operations.
2. Enable multi-factor authentication (MFA): Add an additional layer of security by enabling MFA for the root user. This ensures that even if credentials are compromised, unauthorized access is less likely.
3. Limit the use of the root user: The root user should only be used for tasks that cannot be completed by other IAM users or roles, such as account-level billing changes or closing an account. For all other tasks, create and use IAM users with appropriate permissions.
4. Monitor and log root user activity: Enable AWS CloudTrail logging to track and monitor any actions performed by the root user. This helps in auditing access and identifying any suspicious activities involving the root account.
5. Securely store root credentials: Ensure that the root user credentials are stored securely, preferably in a hardware security module (HSM) or a highly secure password manager. Access to these credentials should be restricted to only authorized personnel.

Supporting Questions:

• How are programmatic access keys managed and secured for the root user?
• What measures are in place to monitor and log root user activities?
• How is the root user’s MFA and credential security handled?

Roles and Responsibilities:

Security Officer:

Responsibilities:

• Ensure root user credentials are secured and programmatic access is disabled.
• Regularly review root user activity for any abnormal or unauthorized actions.
• Implement and enforce MFA on the root user account.

Cloud Administrator:

Responsibilities:

• Configure and enforce IAM policies that limit root user usage.
• Set up CloudTrail logging to monitor root user actions.
• Manage secure storage of root user credentials.

Artefacts:

• Root Access Policies: Documentation outlining the restrictions and controls in place for using the root user.
• MFA Configuration Reports: Reports showing that MFA is enabled for the root user.
• CloudTrail Logs: Records of root user activities for auditing and security purposes.