Ensure No Root User Account Access Key Exists
Specification & Description
Ensure no active programmatic access keys exist for the root user in any AWS account, and prevent their creation organization-wide via SCP.
Technical Specifications
The root user bypasses all IAM permission boundaries and SCPs, making a compromised root access key the highest-severity credential exposure possible in AWS. This control operates at two layers: a preventative SCP applied at the organization root that denies iam:CreateAccessKey when the caller is the root principal, and detective checks via the IAM credential report and the AccountAccessKeysPresent account summary metric. The SCP targets only access key creation - it does not restrict root console sign-in or other root-only emergency operations such as restoring an IAM policy that locks out all users.
Security Rationale
Root access keys are long-lived credentials with no permission boundary and no MFA enforcement at the API level. Any programmatic action should be performed through IAM roles, which support least-privilege scoping, session duration limits, and full CloudTrail attribution. There is no legitimate operational use case for root access keys in a well-configured landing zone.
Operational & Implementation Notes
Root access keys cannot be deleted via the AWS CLI or any API - Console sign-in as root is required. The credential report is eventually consistent and may take time to reflect a newly deleted key; use get-account-summary for an immediate count. The SCP condition aws:PrincipalArn with a wildcard account segment (arn:aws:iam::*:root) correctly matches the root principal in any member account without needing to enumerate account IDs. SCPs apply exclusively to member accounts and do not evaluate or restrict policies within the root account.