Ensure no root account access keys exist
Description
Root account should not have active access keys.
⚠️ Risk Impact
Root access keys provide unrestricted programmatic access. If leaked, the entire AWS account is compromised.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected AWS accounts. Violations are flagged as critical-severity findings with remediation guidance.
🔧 Remediation
Delete root access keys: AWS Console > My Security Credentials > Access keys > Delete.
💀 Real-World Attack Scenario
A startup's CTO created root access keys during the company's founding to set up initial infrastructure. The keys were stored in a shared .env file. Two years later, a departing engineer copied the file and used the root keys to delete production infrastructure as an act of retaliation.
💰 Cost of Non-Compliance
Root access key compromise = total account takeover. AWS reports root key incidents result in average $1.8M in damages. No IAM policies restrict root — the keys bypass all controls.
📋 Audit Questions
- 1.Confirm that no root access keys exist.
- 2.When were root access keys last used?
- 3.Is root account usage monitored via CloudTrail?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Creating root keys 'temporarily' and forgetting to delete them
- ⛔Not monitoring for root key creation events in CloudTrail
- ⛔Using root keys in automation scripts during early company setup
📈 Business Value
Eliminating root access keys removes the single highest-impact credential from your environment. No business function requires root programmatic access — IAM users and roles cover all use cases.
⏱️ Effort Estimate
5 minutes to delete root access keys
EchelonGraph monitors root access key existence in real-time
🔗 Cross-Framework References
Automate CIS AWS 1.4 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →