All checks
Critical
Hardware MFA should be enabled for the root user
Verifies that the root user's MFA is a hardware device (a passkey or security key, or a hardware TOTP token), since an authenticator app may not give the same protection. It fails when the root user has no MFA device, or has any virtual one, even alongside a hardware device, because AWS lets root hold several.
- service
- IAM
- severity
- Critical
- scope
- evaluated once per account
How to fix it
- Can break clients: Afterwards every root sign-in needs a hardware device, so make sure whoever signs in as root has one before any authenticator app is removed.
In the console
As the root user: the account name menu at top right → Security credentials → Multi-factor authentication (MFA)
- MFA device
- Passkey or Security Key, or Hardware TOTP token (AWS recommends registering two)
- Authenticator app devices
- None left: remove each one after the hardware device is assigned
See which of your accounts this check is failing on.
Book a live scan