All checks
Critical
MFA should be enabled for the root user
Checks that the root user has an MFA device, so a stolen root password alone cannot sign in to an account with complete access to everything in it. An account whose root user has no password and no access keys passes, which is what deleting a member account's root credentials through centralized root access leaves.
- service
- IAM
- severity
- Critical
- scope
- evaluated once per account
How to fix it
- Can break clients: Afterwards every root sign-in needs a registered device, so anyone else who signs in as root needs one of their own registered too.
- Affects another check: An Authenticator app clears this but leaves IAM.6 failing; a passkey, security key or hardware TOTP token clears both.
In the console
As the root user: the account name menu at top right → Security credentials → Multi-factor authentication (MFA)
- MFA device
- Any type passes: Passkey or Security Key, Authenticator app, or Hardware TOTP token (AWS recommends registering two)
See which of your accounts this check is failing on.
Book a live scan