Root has signed in

When you sign up for Amazon Web Services, you provide login information (an email address and a password) that is associated with your AWS account. This combination of email address and password represents your AWS root account and its credentials allow complete access to all your AWS services and resources.

Cloud Conformity strongly recommends that you avoid using the AWS root user for your everyday tasks or even for the administrative ones. With Cloud Conformity RTMA root logon detection you will gain real-time visibility into your AWS root account login activity and help you respond fast to any unauthorized access sessions or potential security breaches.

Rationale

Monitoring your root login activity is crucial for keeping your Amazon Web Services account safe. Since the root user acts like a superuser, anyone who has your root credentials can gain unrestricted access to all the resources and services within your AWS environment, including billing information and the ability to change the root password.

The most effective way to reduce the risk of unauthorized access to your AWS account is to avoid sharing the root credentials with other members within your organization and stop using them for everyday access. Instead, the best practice is to provide access to your AWS services and resources through individual IAM users (managed by IAM groups) or programmatically through IAM roles. Using individual IAM users and roles (with specific set of permissions) will eliminate the risk of compromising your root account credentials.

Ideally, the root user will be used only to create an administrator, basically an IAM user with full permissions to your AWS account. And this administrator user should be utilized to create and configure other IAM users and roles with limited permissions that implement the principle of least privilege (i.e. the practice of providing every IAM user the minimal amount of access required to perform its tasks).