Root Account Access Keys Present

01 Sign in to the AWS Management Console using the root account credentials.

02 Click on the AWS account name/number available in the upper-right corner of the Management Console and select My Security Credentials from the dropdown menu.

03 On Your Security Credentials page, click on the Access keys (Access key ID and secret access key) tab to expand the configuration panel with the root access keys.

04 Check the value available in the Status column for each root access key pair to determine the key pair status. If the Management Console displays one or more active access keys, your AWS root account is configured with active access keys, therefore your root access configuration does not follow the IAM security best practices regarding protection against unauthorized access.

05 Repeat steps no. 1 – 4 for each AWS root account that you want to examine.

01 Run get-credential-report command (OSX/Linux/UNIX) to obtain the IAM credential report for your AWS cloud account. A credential report is a CSV document that lists all the AWS users (root and IAM users) created within your AWS cloud account and the current status of their access credentials:

aws iam get-credential-report

02 The command output should return the requested document in a TEXT/CSV format, encoded with the Base64 encoding scheme, as shown in the example below:

{
  "Content": "abcdabcdabcdabcdabcdabcdabcdabc",
  "ReportFormat": "text/csv",
  "GeneratedTime": "2021-04-16T15:00:00+00:00"
}

03 Decode the IAM credential report content from the command line (OSX/Linux/UNIX) using the Base64 string returned at the previous step as the input data. In the following example, the report is decoded and saved to a file named cc-iam-credentials-report.csv:

echo -n abcdabcdabcdabcdabcdabcdabcdabc | base64 –d >> cc-iam-credentials-report.csv

04 Open cc-iam-credentials-report.csv in a text editor and check the value available in the access_key_1_active and access_key_2_active columns for the<root_account> user. If the value set for the access_key_1_active and/or access_key_2_active attributes is TRUE, your AWS root account has at least one active access key pair. Therefore, using active access keys for your AWS root account increases the risk of unauthorized access.

05 Repeat steps no. 1 – 4 for each AWS root account that you want to examine.