Back to Checks
aws

AWS Organization has centralized root credentials management enabled

iam_root_credentials_management_enabled
Service: iamSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesssecrets
Resource Type:Other

AWS Organizations uses centralized root credentials management to control root user credentials across member accounts.

This finding evaluates whether the organization has enabled the RootCredentialsManagement feature to centrally govern presence and recovery of root passwords, access keys, signing certificates, and MFA.

Prowler logoProwlerprowler-provider-aws

Risk

Without central control, member accounts can retain or recover long-term root credentials, weakening confidentiality and integrity.

Threats include:

  • Account takeover via root email recovery
  • Persistent access through root keys
  • Unfixable lockouts from misconfigured policies
  • Bypass of separation of duties

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_root_credentials_management_enabled

Recommendation

Enable centralized root access with root credentials management and assign a delegated administrator.

Apply least privilege and separation of duties by deleting long-term root credentials in members, limiting privileged tasks to short-lived sessions, enforcing MFA, and auditing root-related activity for defense in depth.

Remediation

CLI

aws iam enable-organizations-root-credentials-management

Other

1Sign in to the AWS Management Console with the management account and open IAM
2In the left pane, select "Root access management" and click "Enable"
3In "Capabilities to enable", select only "Root credentials management"
4Click "Enable" to apply
5If prompted, enable trusted access for IAM in AWS Organizations and retry step 3

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client
from prowler.providers.aws.services.organizations.organizations_client import (
    organizations_client,
)


class iam_root_credentials_management_enabled(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if (
            organizations_client.organization
            and organizations_client.organization.status == "ACTIVE"
            and iam_client.organization_features is not None
        ):
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource={},
            )
            report.region = iam_client.region
            report.resource_arn = iam_client.audited_account_arn
            report.resource_id = iam_client.audited_account
            if "RootCredentialsManagement" in iam_client.organization_features:
                report.status = "PASS"
                report.status_extended = "Root credentials management is enabled."
            else:
                report.status = "FAIL"
                report.status_extended = "Root credentials management is not enabled."
            findings.append(report)

        return findings

References