cis-aws-foundations-2-7

name	cis-aws-foundations-2.7
description	Eliminate use of the 'root' user for administrative and daily tasks
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","root","least-privilege","credential-management"]
cis_id	2.7
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.4","cis-aws-foundations-2.5","cis-aws-foundations-2.6"]
prerequisites	[]
severity_boost	{}

Eliminate use of the 'root' user for administrative and daily tasks

Description

With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. This user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks.

Rationale

The 'root user' has unrestricted access to and control over all account resources. Use of this account is inconsistent with the principles of least privilege and separation of duties and can lead to unnecessary harm due to user error or account compromise.

Impact

Use of the root account for routine activities increases the risk of accidental or unauthorized changes, potentially resulting in full account compromise.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam.
2. In the left pane, click Credential Report.
3. Select Download Report.
4. Open or Save the file locally.
5. Locate the root user under the user column.
6. Review:
   • password_last_used
   • access_key_1_last_used_date
   • access_key_2_last_used_date
7. Determine whether recent usage indicates frequent or inappropriate use of the root account.
8. Ensure the mfa_active field is set to TRUE or the password_enabled field is set to FALSE.

Using AWS CLI

1. Run the following CLI commands to provide a credential report for determining the last time the 'root user' was used:

aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,5,11,16 | grep -B1 '<root_account>'

2. Review:
   • password_last_used
   • access_key_1_last_used_date
   • access_key_2_last_used_date
3. Determine when the root user was last used.

Note: There are limited scenarios where use of the 'root' user is required. Refer to AWS documentation for a complete list.