IAM Root User Should Not Have Access Keys Rule
This rule ensures that the IAM root user does not have access keys for enhanced security.
| Rule | IAM root user should not have access keys |
| Framework | NIST Cybersecurity Framework (CSF) v1.1 |
| Severity | ✔ Medium |
Rule Description:
The rule states that the AWS Identity and Access Management (IAM) root user should not have any access keys configured for NIST Cybersecurity Framework (CSF) v1 compliance. The CSF v1 is a set of guidelines and best practices for enhancing the cybersecurity posture of organizations.
Having access keys for the root user can pose security risks as they grant unrestricted access to all resources in the AWS account. To ensure compliance with CSF v1, it is recommended to disable access keys for the root user.
Troubleshooting Steps:
If access keys for the root user are found, the following troubleshooting steps can be followed:
- 1.Log in to the AWS Management Console using the root user credentials.
- 2.Navigate to the IAM service.
- 3.On the IAM dashboard, select the "Users" tab.
- 4.Locate the root user in the list of users.
- 5.Verify if the root user has any access keys associated with it.
- 6.If access keys are found, proceed to remediation steps.
Remediation:
The remediation process involves disabling and deleting any existing access keys for the root user.
Method 1: Using the AWS Management Console
- 1.Log in to the AWS Management Console using the root user credentials.
- 2.Navigate to the IAM service.
- 3.On the IAM dashboard, select the "Users" tab.
- 4.Locate the root user in the list of users.
- 5.Click on the username to access the user's details.
- 6.In the "Security credentials" tab, under "Access keys", click on the "Manage access keys" button.
- 7.If any access keys are present, remove them by selecting the key and clicking on the "Delete access key" button.
- 8.Confirm the deletion when prompted.
Method 2: Using AWS CLI
- 1.Install and configure AWS CLI on your local machine.
- 2.Open a command prompt or terminal.
- 3.Run the following command to list the access keys for the root user:
Replaceaws iam list-access-keys --user-name <root_user_name>
with the actual username of the root user.<root_user_name> - 4.If any access keys are listed, run the following command to delete them:
Replaceaws iam delete-access-key --access-key-id <access_key_id> --user-name <root_user_name>
with the actual Access Key ID and<access_key_id>
with the root user's username.<root_user_name> - 5.Confirm the deletion when prompted.
Conclusion:
Disabling access keys for the IAM root user ensures compliance with the NIST Cybersecurity Framework (CSF) v1 by reducing the risk of unauthorized access to AWS resources. Following the provided step-by-step remediation guide using either the AWS Management Console or AWS CLI will help enforce this security measure.