Do not use the AWS account root user for daily operations.
Reduce the impact if the root credentials are exposed.
Choose TWO appropriate measures.
Enable MFA for the root user and avoid creating a root access key so the most powerful credentials have a smaller exposure surface.
Detailed explanation
Sharing removes individual traceability and increases the chance of credential disclosure.
Sharing removes individual traceability and increases the chance of credential disclosure.
MFA adds another authentication factor even if the root password is compromised.
MFA adds another authentication factor even if the root password is compromised.
Avoiding a long-term root key reduces the risk of exposing the account's strongest programmatic credential.
Avoiding a long-term root key reduces the risk of exposing the account's strongest programmatic credential.
Embedding a powerful long-term credential creates a severe and avoidable risk.
Embedding a powerful long-term credential creates a severe and avoidable risk.
Check official documentation
Compare the following points with the official documentation.
AWSアカウントrootユーザーのベストプラクティスを確認する。
What to confirm
root保護にMFAと長期キー削除を適用できる。
Key points
- Root user
- MFA
- Access key
Notes
- Environment: AWS公式IAMドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Strongest credential
Root access has exceptional impact, so it should be reserved for required tasks and protected separately.
Human and programmatic access
MFA protects interactive authentication while avoiding a root access key removes an unnecessary API credential.