Root user has access keys

Severity: Low
Service: IAM
Check ID: ROOT_USER_HAS_ACCESS_KEYS

What this check finds

The root user should be used only in exceptional cases, and should therefore not use access keys. IAM Users or Roles should be used instead.

Passing looks like: Root user has no access keys.

How to fix it

Delete root access keys immediately — this cannot be done via CLI (root credentials required). Sign in as root → IAM → Security credentials → Access keys → Delete. Replace with IAM Users or Roles with least-privilege permissions.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Root user has access keys
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.3 Ensure no 'root' user account access key exists
PCI-DSS v4.0.1	8.6 Use of application and system accounts and associated authentication factors is managed
HIPAA Security Rule	164.308(a)(3) Workforce Security — Access Authorization 164.312(a)(2)(i) Unique User Identification
SOC 2 — Trust Services Criteria	CC6.3 Multi-Factor Authentication
NIST SP 800-53 Rev5 (Moderate)	AC-6 Least Privilege IA-5 Authenticator Management
NIST Cybersecurity Framework 2.0	PR.AA-01 Identities and credentials are managed PR.AA-05 Access permissions and authorizations are enforced with least privilege
ISO/IEC 27001:2022 Annex A	A.5.17 Authentication information A.8.2 Privileged access rights

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks