← Back to Tutorials
Tutorial 01 Beginner

How to Secure Your AWS Root Account in 15 Minutes

Your root account is the master key to your entire AWS infrastructure. Learn how to properly secure it with MFA, IAM admin users, and monitoring.

15 min implementation
8 min read
Core Security

What You'll Learn

Why AWS Root Account Security is Critical

Your AWS root account has unrestricted access to every service and resource in your AWS account. Unlike IAM users, the root account cannot be limited by policies. This includes the ability to:

  • Close your AWS account permanently
  • Change billing information and payment methods
  • Create, modify, or delete any AWS resource
  • View and download detailed billing reports
  • Enable or disable any AWS service
  • Modify support plans and account settings
⚠️
Critical: AWS strongly recommends never using the root account for daily operations. The root account should only be used for the specific tasks that require it, such as changing account settings or closing the account.

The Three Most Common Root Account Vulnerabilities

1

No Multi-Factor Authentication

Without MFA, your root account is protected only by a password. If compromised through phishing or data breaches, attackers gain complete control of your AWS environment.

2

Daily Operational Use

Using the root account for routine tasks increases exposure risk. Each login creates an opportunity for credential theft, especially when credentials are shared among team members.

3

Programmatic Access Keys

Root account access keys stored in code repositories or CI/CD systems represent the highest-risk scenario—providing unrestricted API access to your entire account.

1

Enable MFA on Your Root Account

~5 minutes

Prerequisites

  • Access to your AWS root account credentials
  • A smartphone with an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator)
  • Alternative: Hardware MFA device (recommended for production environments)

Console Steps

1.1 Sign in to AWS Console

  • Go to https://console.aws.amazon.com/
  • Select "Root user" and enter your root account email
  • Enter your root account password

1.2 Navigate to Security Credentials

  • Click on your account name in the top-right corner
  • Select "Security credentials" from the dropdown menu

1.3 Enable MFA

  • Find the "Multi-factor authentication (MFA)" section
  • Click "Assign MFA device"
  • Choose "Authenticator app" (recommended for most users)
  • Click "Next"

1.4 Configure Your Authenticator App

  • Open your authenticator app on your smartphone
  • Scan the QR code displayed in the AWS Console
  • Enter the first 6-digit code from your app
  • Wait for the code to refresh, then enter the second code
  • Click "Add MFA"
✓
Success! Your root account now has MFA protection. You'll need both your password and the authenticator code for future logins.
⚠️
Important: Save your MFA recovery information in a secure location. If you lose access to your authenticator device, you'll need to contact AWS Support to regain access.
2

Create IAM Administrative Users

~5 minutes

Instead of using the root account for daily operations, create IAM users with administrative privileges. This follows the principle of least privilege while maintaining necessary access.

Console Steps

2.1 Navigate to IAM Service

  • In the AWS Console, search for "IAM" in the services search bar
  • Click on "IAM" to open the Identity and Access Management console

2.2 Create Admin User Group

  • Click "User groups" in the left navigation panel
  • Click "Create group"
  • Group name: Administrators
  • Attach policies: Search and select AdministratorAccess
  • Click "Create group"
AWS CLI Alternative 
# Create admin group via AWS CLI
aws iam create-group --group-name Administrators

aws iam attach-group-policy \
    --group-name Administrators \
    --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

2.3 Create IAM Administrative User

  • Click "Users" in the left navigation panel
  • Click "Create user"
  • Username: admin-[your-name] (e.g., admin-john-doe)
  • Check "Provide user access to the AWS Management Console"
  • Select "I want to create an IAM user"
  • Choose "Custom password" and create a strong password
  • Click "Next"

2.4 Add User to Admin Group

  • Select "Add user to group"
  • Check the "Administrators" group you created
  • Click "Next"
  • Review the configuration and click "Create user"

2.5 Enable MFA for Admin User

  • Click on the newly created user
  • Go to the "Security credentials" tab
  • In the "Multi-factor authentication (MFA)" section, click "Assign MFA device"
  • Follow the same MFA setup process as for the root account
💡
Best Practice: Create separate admin users for each team member rather than sharing credentials. This provides accountability and allows for individual access control.
3

Remove Root Account Access Keys

~2 minutes

Root account access keys provide programmatic access to your entire AWS account without MFA protection. These should never exist for the root account.

Console Steps

3.1 Check for Existing Access Keys

  • While signed in as root, go to "Security credentials"
  • Scroll down to the "Access keys" section
  • Check if any access keys are listed

3.2 Delete Any Existing Access Keys

  • For each access key listed:
  • Click "Actions" → "Delete"
  • Confirm the deletion when prompted
⚠️
Important: Before deleting access keys, ensure they're not being used in production applications. If they are, first create IAM user access keys with appropriate permissions, update your applications, then delete the root access keys.
AWS CLI Commands 
# Check for root account access keys
aws iam list-access-keys

# If access keys exist, delete them (replace ACCESS_KEY_ID)
aws iam delete-access-key --access-key-id ACCESS_KEY_ID
✓
Security Win: Your root account can no longer be used for programmatic access, significantly reducing your attack surface.
4

Set Up Root Account Monitoring

~3 minutes

Monitor root account usage to detect unauthorized access attempts or accidental usage by team members.

4.1 Enable CloudTrail (if not already enabled)

  • Navigate to CloudTrail service
  • Click "Create trail"
  • Trail name: security-audit-trail
  • Enable "Log file validation"
  • Choose an S3 bucket for log storage
  • Enable CloudWatch Logs integration
  • Click "Create trail"

4.2 Create CloudWatch Alarm for Root Account Usage

Metric Filter Pattern 
{ ($.userIdentity.type = "Root") && ($.userIdentity.invokedBy NOT EXISTS) && ($.eventType != "AwsServiceEvent") }

4.3 Set Up Email Notifications

AWS CLI Commands 
# Create SNS topic for root account alerts
aws sns create-topic --name root-account-usage-alerts

# Subscribe email to the topic (replace with your email)
aws sns subscribe \
    --topic-arn arn:aws:sns:us-east-1:ACCOUNT_ID:root-account-usage-alerts \
    --protocol email \
    --notification-endpoint EMAIL ADDRESS
✓
Monitoring Active: You'll now receive immediate alerts whenever the root account is used, enabling rapid incident response.

Validate Your Configuration

Complete these checks to ensure your root account is properly secured:

Security Validation Script

Run this script to programmatically verify your root account security:

Bash Script 
#!/bin/bash
# Root Account Security Validation Script

echo "Checking root account security configuration..."

# Check for root account access keys
echo "Checking for root account access keys..."
KEYS=$(aws iam list-access-keys --query 'AccessKeyMetadata[*].AccessKeyId' --output text)
if [ -z "$KEYS" ]; then
    echo "✓ No root account access keys found"
else
    echo "✗ WARNING: Root account access keys detected!"
fi

# Check MFA status
echo "Checking MFA status..."
MFA=$(aws iam list-mfa-devices --query 'MFADevices[*].SerialNumber' --output text)
if [ -n "$MFA" ]; then
    echo "✓ MFA device configured"
else
    echo "✗ WARNING: No MFA device found!"
fi

# Check CloudTrail status
echo "Checking CloudTrail configuration..."
TRAILS=$(aws cloudtrail describe-trails --query 'trailList[*].IsMultiRegionTrail' --output text)
if [[ "$TRAILS" == *"True"* ]]; then
    echo "✓ Multi-region CloudTrail enabled"
else
    echo "! Consider enabling multi-region CloudTrail"
fi

echo ""
echo "Security validation complete!"

Common Mistakes to Avoid

✗

Sharing root credentials among team members. Create individual IAM admin users instead.

✗

Using root for automation or CI/CD pipelines. Create IAM roles with specific permissions instead.

✗

Storing MFA backup codes in the same location as passwords. Keep them in separate, secure locations.

✗

Ignoring root usage alerts. Every root account usage should be investigated and justified.

Want Automated Security Monitoring?

Manually checking security configurations is time-consuming and error-prone. AWSight automatically monitors your AWS environment against 500+ security best practices daily—including root account security.

View Pricing Plans Browse All Tutorials

References