Security Hub - IAM.9 MFA should be enabled for the root user - finding

Question

Hi,

I configured a new feature, Root Access Management, in the IAM console and performed the 'Delete root user credentials' action for one member account. As a result, this AWS account no longer has root credentials. However, I still see the IAM.9: MFA should be enabled for the root user finding in the Security Hub. How can I resolve this?

re:Post Agent · Accepted Answer

The situation you're describing is a common occurrence when using AWS Organizations with Root Access Management enabled for member accounts. Even though you've deleted the root user credentials for a member account, the Security Hub finding IAM.9 (MFA should be enabled for the root user) may still persist. This is because the finding is based on a general best practice that doesn't always align with the specific configuration of accounts managed by AWS Organizations.

In your case, by deleting the root user credentials, you've effectively removed the password, access keys, signing certificates, and deactivated multi-factor authentication (MFA) for the root user of that member account. This action prevents the account from signing in as a root user and from recovering the root user password.

Unfortunately, the Security Hub finding IAM.9 may not automatically recognize this configuration as compliant, even though the account is actually more secure without root user access. This is because the rule is designed to check if MFA is enabled for the root user, which is not possible when root credentials don't exist.

To address this situation, you have a few options:

1. You can suppress this finding in Security Hub for the specific account, explaining in the suppression reason that root access management is enabled and root credentials have been deleted.

2. You can create a custom rule or modify existing rules in AWS Config (which feeds into Security Hub) to account for this scenario.

3. You can contact AWS Support to explain the situation and ask for guidance on how to resolve the finding given your specific account configuration.

It's important to note that while this finding persists, it doesn't necessarily indicate a security vulnerability in your account. The deletion of root user credentials is actually a strong security measure that goes beyond simply enabling MFA.

If you need to perform any actions that require root user access in the future, you'll need to contact your AWS Organizations administrator, as they will have the ability to manage root access for member accounts.  
**Sources**  
[Accessing a member account as the root user with AWS Organizations - AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access-as-root.html)  
[root-account-mfa-enabled - AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/root-account-mfa-enabled.html)

Murakami_R · Answer

This article is no longer necessary. Control IAM.9 has been updated to evaluate root users without credentials as PASSED.

[+] https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-9

```
This control generates PASSED findings in the following cases:

- Root user credentials are present in the account and MFA is enabled for the root user.
- Root user credentials aren’t present in the account.
```

Security Hub - IAM.9 MFA should be enabled for the root user - finding

Add your answer

Relevant content