All checks
Critical
IAM root user access key should not exist
Checks that the root user has no access keys. A root key gives long-term, unrestricted API access to the whole account, so programmatic work belongs on an IAM role instead. In an organization with centralized root access, the management account or a delegated administrator can delete a member's root credentials from Root access management without signing in as root.
- service
- IAM
- severity
- Critical
- scope
- evaluated once per account
How to fix it
- Can break clients: Anything still signing requests with the key gets access denied once it is deactivated, so move that work onto an IAM role or IAM Identity Center first.
- Can't be undone: A deleted key cannot be restored, while a deactivated one can be made active again with the same key ID and secret.
- Affects another check: Deleting a member account's root credentials through centralized root access clears this along with IAM.6 and IAM.9, which pass an account with no root credentials.
In the console
As the root user: the account name menu at top right → Security credentials → Access keys
- Actions
- Deactivate each key first, then Delete it once nothing has failed (Delete asks for the access key ID)
See which of your accounts this check is failing on.
Book a live scan