AWS Root Account Has MFA Enabled
These policy validates that Multi Factor Authentication (MFA) is required for access to the root account, and that a hardware MFA device is in use.
The root account has the most privilege/access of any account, and should therefore be the most protected account. Enabling MFA mitigates much of the possibility of account compromise as both the password and the MFA device would need to be compromised at once for the account to be compromised. Hardware MFA is preferred as it is more difficult to compromise than a virtual MFA device.
To remediate this, enable MFA for logins with the root account. This must be done from the AWS console, logged in as the root account.
- CIS AWS Benchmark 1.13 "Ensure MFA is enabled for the "root" account".
- CIS AWS Benchmark 1.14 "Ensure hardware MFA is enabled for the "root" account".