Eliminate use of the 'root' user for administrative and daily tasks

高等級 1人工審核aws

說明

With the creation of an AWS account, a 'root user' is created that cannot be disabled or deleted. This user has unrestricted access to and control over all resources in the AWS account. It is highly recommended that the use of this account be avoided for everyday tasks. The 'root user' has unrestricted access to and control over all account resources. Use of this account is inconsistent with the principles of least privilege and separation of duties and can lead to unnecessary harm due to user error or account compromise.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

From Console: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam 2. In the left pane, click Credential Report 3. Select Download Report 4. Open or Save the file locally 5. Locate the root user under the user column 6. Review: - password_last_used - access_key_1_last_used_date - access_key_2_last_used_date 7. Determine whether recent usage indicates frequent or inappropriate use of the root account 8. Ensure the mfa_active field is set to TRUE or the password_enabled field is set to FALSE From Command Line: 1. Run the following CLI commands to provide a credential report for determining the last time the 'root user' was used: aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,5,11,16 | grep -B1 '<root_account>' 2. Review: - password_last_used - access_key_1_last_used_date - access_key_2_last_used_date 3. Determine when the root user was last used Note: There are limited scenarios where use of the 'root' user is required. Refer to AWS documentation for a complete list.

修補方式

修補方法: 操作指南或基礎設施修補檔

If the 'root' user account is being used for daily activities or administrative tasks that do not require root access: 1. Stop using the root account for routine operations 2. Create and use IAM roles or users with least privilege instead 3. Change the root user password 4. Deactivate or delete any access keys associated with the root user From Command Line: 1. Run the following command as the root user in the account to delete the root login profile: aws iam delete-login-profile This removes the password associated with the root account and prevents console authentication using the root user.

屬性

作業系統: 不限
標籤: awscloud
參考資料: CIS Amazon Web Services Foundations Benchmark v7.0.0 - 2.7 Eliminate use of the 'root' user for administrative and daily tasks