Root Account Active Signing Certificates

01 Sign in to the AWS Management Console using the root account credentials.

02 Click on the AWS account name or number available in the upper-right corner of the management console and select My Security Credentials from the dropdown menu.

03 On Your Security Credentials page, click on the X.509 certificate tab to expand the panel with the X.509 certificates deployed for your root account.

04 Within the X.509 certificates table, in the Status column, check for any certificates with the status set to Active. If the table lists one or more active certificates:

there are active X.509 signing certificates deployed for your AWS root user, therefore your root account access configuration does not follow AWS security best practices.

05 Repeat steps no. 1 – 4 for each Amazon Web Services root account that you want to examine for active X.509 certificates.

01 Run get-credential-report command (OSX/Linux/UNIX) to obtain the IAM credential report for your AWS account. A credential report is a document that lists all the AWS users (root and IAM users) and the current status of their credentials:

aws iam get-credential-report

02 The command output should return the document in a TEXT/CSV format, encoded with the Base64 encoding scheme:

{
    "Content": "cx7lcixhcm4sdXNlcl9jcmdz ... cdXyLE4vQSxmYWxzZSxOl04=",
    "GeneratedTime": "2018-01-18T16:13:01Z",
    "ReportFormat": "text/csv"
}

03 Decode the IAM credential report content from the command line (OSX/Linux/UNIX) using the Base64 string returned at the previous step as the input data. In the following example, the report is decoded and saved to a file named aws-iam-credentials-report.csv:

echo -n aaaabbbbccccddddeeee ... ffffgggghhhhiiiijjjj= | base64 –d >> aws-iam-credentials-report.csv

04 Open aws-credentials-report.csv in your favorite CSV file editor and check the values available within cert_1_active and cert_2_active columns for the AWS root account. If one or both cert_1_active and cert_2_active parameters have their value set to TRUE, e.g.

your AWS root user has active X.509 signing certificates, therefore your root account access configuration does not follow AWS security best practices.

05 Repeat steps no. 1 – 4 for each Amazon Web Services root account that you want to examine.