TMA-AWS-2.4
Ensure no 'root' user account access key exists
Mô tả
The 'root' user account is the most privileged user in an AWS account. AWS access keys provide programmatic access to a given AWS account. It is recommended that all access keys associated with the 'root' user account be deleted. Deleting access keys associated with the 'root' user account limits the vectors by which the account can be compromised. Additionally, removing 'root' access keys encourages the use of role-based access with least privilege.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
Perform the following to determine if the 'root' user account has access keys: From Console: 1. Login to the IAM Management Console (https://console.aws.amazon.com/iam) 2. Click on Credential Report. 3. Download the .csv file which contains credential usage for all IAM users within an AWS Account 4. Open the file 5. For the root user, ensure the access_key_1_active and access_key_2_active fields are set to FALSE. From Command Line: 1. Run the following command: aws iam get-account-summary | grep "AccountAccessKeysPresent" 2. If no 'root' access keys exist the output will show "AccountAccessKeysPresent": 0, 3. If the output shows a "1", then 'root' keys exist and should be deleted
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Perform the following to delete active 'root' user access keys. From Console: 1. Sign in to the AWS Management Console as 'root' and open the IAM console at https://console.aws.amazon.com/iam/ 2. Click on <root_account> at the top right and select Security Credentials from the drop down list 3. Click on Access Keys (Access Key ID and Secret Access Key) 4. If there are active keys: - Deactivate the key under Status - Click Delete (Deleted keys cannot be recovered) Note: While a key can be made inactive, it will still appear in CLI audit output and may result in a false positive. Keys should be deleted to ensure compliance.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- access-controlawscloudcrypto
- Tham chiếu
- CIS Amazon Web Services Foundations Benchmark v7.0.0 - 2.4 Ensure no 'root' user account access key exists