Lock the root account away

How to do it

The root account can do anything, including closing the account. Use it only for the few tasks that need it. Register at least two hardware keys and store them apart. Point its email address at a shared group mailbox, not one person. In AWS Organizations, turn on central root access and delete the root credentials of member accounts. Alert the team on any root sign-in.

Example

# Expect: mfa=true key1=false key2=false
aws iam get-credential-report --query Content --output text | base64 -d \
  | awk -F, '$1=="<root_account>" {print "mfa="$8, "key1="$9, "key2="$14}'

{
  "source": ["aws.signin"],
  "detail-type": ["AWS Console Sign In via CloudTrail"],
  "detail": { "userIdentity": { "type": ["Root"] } }
}

How to check

In the credential report, the root user of the management account has MFA on and no active access keys. Member accounts show no root password. A test root sign-in in a sandbox account triggers the alert within 15 minutes.