IAM root user must not have access keys

Critical AWS General aws-iam-user-no-root-access

Applies to

AWS::IAM::User

What CGPulse checks

A resource passes this rule when accessKeyCount must equal 0. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Delete root account access keys and use IAM roles for programmatic access. In AWS Console: IAM > Root user > Security credentials > delete access keys. See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html

Terraform

# Root access keys must be deleted via AWS Console
# No Terraform resource exists for root account keys

Compliance frameworks

Cloud Foundations Benchmark v3.01.4
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.308(a)(4)
ISO 27001: Information SecurityA.9.2.3
NIST 800-53: Cloud Security ControlsAC-6
PCI DSS v4.07.2.1
SOC 2: Trust ServicesCC6.3

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan