---
title: "Lock the root account away · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access/lock-root-account
updated: 2026-10-20
licence: "All rights reserved"
---

# Lock the root account away

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)
- Rule: Protect every cloud root or owner account with a hardware key or passkey, give it no access keys, and alert on every sign-in.
- How: The root account can do anything, including closing the account. Use it only for the few tasks that need it. Register at least two hardware keys and store them apart. Point its email address at a shared group mailbox, not one person. In AWS Organizations, turn on central root access and delete the root credentials of member accounts. Alert the team on any root sign-in.
- Check: In the credential report, the root user of the management account has MFA on and no active access keys. Member accounts show no root password. A test root sign-in in a sandbox account triggers the alert within 15 minutes.

Example:

```sh
# Expect: mfa=true key1=false key2=false
aws iam get-credential-report --query Content --output text | base64 -d \
  | awk -F, '$1=="<root_account>" {print "mfa="$8, "key1="$9, "key2="$14}'
```

```json
{
  "source": ["aws.signin"],
  "detail-type": ["AWS Console Sign In via CloudTrail"],
  "detail": { "userIdentity": { "type": ["Root"] } }
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/identity-and-access/lock-root-account`.

- Previous: [Separate the roles for plan and apply](https://agentwranglers.se/playbook/infrastructure/identity-and-access/separate-plan-and-apply-roles)
- Next: [Keep tested break-glass accounts](https://agentwranglers.se/playbook/infrastructure/identity-and-access/break-glass-access)
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)