- 最新
- 最多得票
- 最多評論
This article is no longer necessary. Control IAM.9 has been updated to evaluate root users without credentials as PASSED.
[+] https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html#iam-9
This control generates PASSED findings in the following cases:
- Root user credentials are present in the account and MFA is enabled for the root user.
- Root user credentials aren’t present in the account.
The situation you're describing is a common occurrence when using AWS Organizations with Root Access Management enabled for member accounts. Even though you've deleted the root user credentials for a member account, the Security Hub finding IAM.9 (MFA should be enabled for the root user) may still persist. This is because the finding is based on a general best practice that doesn't always align with the specific configuration of accounts managed by AWS Organizations.
In your case, by deleting the root user credentials, you've effectively removed the password, access keys, signing certificates, and deactivated multi-factor authentication (MFA) for the root user of that member account. This action prevents the account from signing in as a root user and from recovering the root user password.
Unfortunately, the Security Hub finding IAM.9 may not automatically recognize this configuration as compliant, even though the account is actually more secure without root user access. This is because the rule is designed to check if MFA is enabled for the root user, which is not possible when root credentials don't exist.
To address this situation, you have a few options:
-
You can suppress this finding in Security Hub for the specific account, explaining in the suppression reason that root access management is enabled and root credentials have been deleted.
-
You can create a custom rule or modify existing rules in AWS Config (which feeds into Security Hub) to account for this scenario.
-
You can contact AWS Support to explain the situation and ask for guidance on how to resolve the finding given your specific account configuration.
It's important to note that while this finding persists, it doesn't necessarily indicate a security vulnerability in your account. The deletion of root user credentials is actually a strong security measure that goes beyond simply enabling MFA.
If you need to perform any actions that require root user access in the future, you'll need to contact your AWS Organizations administrator, as they will have the ability to manage root access for member accounts.
Sources
Accessing a member account as the root user with AWS Organizations - AWS Organizations
root-account-mfa-enabled - AWS Config
相關內容
已提問 10 個月前
已提問 3 個月前
