Back to Checks
aws

[DEPRECATED] AWS root user has security challenge questions configured

account_security_questions_are_registered_in_the_aws_account
Service: accountSeverity: medium
OfficialBuilt-inVerified
Resource Type:Other

[DEPRECATED] AWS account root configuration may include legacy security challenge questions for support identity verification. This evaluates whether those questions are set on the account. New configuration is discontinued by AWS and remaining support for this feature is time-limited.

Prowler logoProwlerprowler-provider-aws

Risk

Absence of these questions can limit support-assisted recovery if root credentials or MFA are lost, reducing availability and slowing incident response. Reliance on KBA also weakens confidentiality due to social engineering. Treat this as a recovery gap and adopt stronger, phishing-resistant factors.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks account_security_questions_are_registered_in_the_aws_account

Recommendation

Favor stronger recovery instead of KBA:

  • Enforce MFA for root and minimize root use
  • Keep alternate contacts and root email current and protected
  • Establish a tightly controlled break-glass role, applying least privilege and separation of duties
  • Document and test recovery procedures; monitor root activity

Remediation

Other

1Sign in to the AWS Management Console
2Navigate to your AWS account settings page at https://console.aws.amazon.com/billing/home?#/account/
3Scroll down to Configure Security Challenge Questions section and click the Edit link
4Select three different questions made available by Amazon and provide appropriate answers
5Store the answers in a secure but accessible location
6Click the Update button to save the changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.account.account_client import account_client

# This check has no findings since it is manual


class account_security_questions_are_registered_in_the_aws_account(Check):
    def execute(self):
        report = Check_Report_AWS(metadata=self.metadata(), resource={})
        report.region = account_client.region
        report.resource_id = account_client.audited_account
        report.resource_arn = account_client.audited_account_arn
        report.status = "MANUAL"
        report.status_extended = "Login to the AWS Console as root. Choose your account name on the top right of the window -> My Account -> Configure Security Challenge Questions."
        return [report]

References