Check the AWS Root User for MFA and Access Keys

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RootUserChecks",
      "Effect": "Allow",
      "Action": [
        "iam:GetAccountSummary",
        "iam:GenerateCredentialReport",
        "iam:GetCredentialReport",
        "iam:ListVirtualMFADevices"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CentralizedRootAccessOptional",
      "Effect": "Allow",
      "Action": "iam:ListOrganizationsFeatures",
      "Resource": "*"
    }
  ]
}

// check-root-account-mfa-and-access-keys.ts
// Checks the AWS account root user: MFA, access keys, signing certificates, whether a password exists and
// when it was last used. Uses GetAccountSummary, the IAM credential report and ListVirtualMFADevices.
// With --org, also shows which centralized root access features are on (management or delegated admin account).
// Report-only: it never changes the root user.
// Usage: npx tsx check-root-account-mfa-and-access-keys.ts [--days=90] [--org]
import {
  IAMClient,
  GetAccountSummaryCommand,
  GenerateCredentialReportCommand,
  GetCredentialReportCommand,
  ListOrganizationsFeaturesCommand,
  paginateListVirtualMFADevices,
} from "@aws-sdk/client-iam";
import { STSClient, GetCallerIdentityCommand } from "@aws-sdk/client-sts";

const args = process.argv.slice(2);
const checkOrg = args.includes("--org");
const recentDays = Number(args.find((a) => a.startsWith("--days="))?.split("=")[1] ?? "90");

type Severity = "CRITICAL" | "HIGH" | "MEDIUM" | "INFO" | "OK";
interface Check {
  Check: string;
  Result: string;
  Severity: Severity;
}

const iam = new IAMClient({});
const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));

// The credential report is CSV with no quoted fields; the first line is the header.
function parseCsv(text: string): Record<string, string>[] {
  const [header, ...lines] = text.trim().split(/\r?\n/);
  const cols = header.split(",");
  return lines.map((line) => {
    const cells = line.split(",");
    return Object.fromEntries(cols.map((c, i) => [c, cells[i] ?? ""]));
  });
}

// GenerateCredentialReport returns STARTED, INPROGRESS or COMPLETE. IAM reuses a report younger than 4 hours.
async function rootRow(): Promise<Record<string, string> | undefined> {
  for (let attempt = 0; attempt < 15; attempt++) {
    const { State } = await iam.send(new GenerateCredentialReportCommand({}));
    if (State === "COMPLETE") break;
    await sleep(2000);
  }
  const report = await iam.send(new GetCredentialReportCommand({}));
  const text = new TextDecoder().decode(report.Content ?? new Uint8Array());
  return parseCsv(text).find((row) => row.arn?.endsWith(":root"));
}

function daysAgo(value: string | undefined): number | undefined {
  if (!value || !/^\d{4}-/.test(value)) return undefined; // N/A, no_information, not_supported
  return Math.floor((Date.now() - Date.parse(value)) / 86_400_000);
}

async function rootHasVirtualMfa(): Promise<boolean> {
  for await (const page of paginateListVirtualMFADevices({ client: iam }, { AssignmentStatus: "Assigned" })) {
    if ((page.VirtualMFADevices ?? []).some((d) => d.User?.Arn?.endsWith(":root"))) return true;
  }
  return false;
}

async function orgFeatures(): Promise<string> {
  try {
    const out = await iam.send(new ListOrganizationsFeaturesCommand({}));
    const enabled = out.EnabledFeatures ?? [];
    return enabled.length ? enabled.join(", ") : "none enabled";
  } catch (err) {
    return `unavailable (${err instanceof Error ? err.name : String(err)})`;
  }
}

async function main(): Promise<void> {
  const account = (await new STSClient({}).send(new GetCallerIdentityCommand({}))).Account ?? "?";
  const summary = (await iam.send(new GetAccountSummaryCommand({}))).SummaryMap ?? {};
  const mfaOn = summary.AccountMFAEnabled === 1;
  const passwordPresent = summary.AccountPasswordPresent === 1;
  const keysPresent = summary.AccountAccessKeysPresent === 1;
  const certsPresent = summary.AccountSigningCertificatesPresent === 1;
  const row = await rootRow();
  const checks: Check[] = [];

  // MFA
  if (mfaOn) {
    const virtual = await rootHasVirtualMfa();
    checks.push({
      Check: "Root MFA",
      Result: virtual ? "enabled (a virtual MFA device is assigned)" : "enabled (hardware key, passkey or TOTP token)",
      Severity: virtual ? "INFO" : "OK",
    });
  } else if (passwordPresent) {
    checks.push({ Check: "Root MFA", Result: "NOT enabled and the root user has a password", Severity: "CRITICAL" });
  } else {
    checks.push({ Check: "Root MFA", Result: "no MFA, but no root password either (credentials removed)", Severity: "OK" });
  }

  // Access keys: the summary says whether any exist; the report says whether they're active and used.
  for (const n of [1, 2]) {
    if (row?.[`access_key_${n}_active`]?.toLowerCase() === "true") {
      const used = row[`access_key_${n}_last_used_date`];
      const service = row[`access_key_${n}_last_used_service`];
      checks.push({
        Check: `Root access key ${n}`,
        Result: `ACTIVE, created ${row[`access_key_${n}_last_rotated`]?.slice(0, 10)}, last used ${used === "N/A" ? "never" : `${used?.slice(0, 10)} (${service})`}`,
        Severity: "CRITICAL",
      });
    }
  }
  if (keysPresent && !checks.some((c) => c.Check.startsWith("Root access key"))) {
    checks.push({ Check: "Root access keys", Result: "present but inactive; delete them", Severity: "HIGH" });
  }
  if (!keysPresent) checks.push({ Check: "Root access keys", Result: "none", Severity: "OK" });

  // Signing certificates are another long-term root credential.
  checks.push(certsPresent
    ? { Check: "Root signing certificates", Result: "present; delete them unless a legacy tool needs them", Severity: "MEDIUM" }
    : { Check: "Root signing certificates", Result: "none", Severity: "OK" });

  // Password and last console sign-in.
  const lastUsed = row?.password_last_used;
  const age = daysAgo(lastUsed);
  checks.push({
    Check: "Root password",
    Result: passwordPresent ? `present, last used ${age === undefined ? lastUsed ?? "unknown" : `${lastUsed?.slice(0, 10)} (${age} days ago)`}` : "none",
    Severity: age !== undefined && age <= recentDays ? "MEDIUM" : passwordPresent ? "INFO" : "OK",
  });

  if (checkOrg) checks.push({ Check: "Centralized root access", Result: await orgFeatures(), Severity: "INFO" });

  console.log(`Account ${account} root user (${row?.arn ?? "row not found in credential report"})`);
  console.table(checks);
  const serious = checks.filter((c) => c.Severity === "CRITICAL" || c.Severity === "HIGH").length;
  console.log(`${serious} CRITICAL/HIGH finding(s). Root sign-ins within ${recentDays} days are flagged MEDIUM.`);
  if (serious) process.exitCode = 2;
}

main().catch((err) => {
  console.error(err instanceof Error ? `${err.name}: ${err.message}` : err);
  process.exit(1);
});

npm install @aws-sdk/client-iam @aws-sdk/client-sts
npm install --save-dev tsx typescript

# One account, flag root sign-ins in the last 90 days
AWS_PROFILE=security-audit npx tsx check-root-account-mfa-and-access-keys.ts

# From the management account: also show centralized root access, flag sign-ins in the last 30 days
AWS_PROFILE=org-admin npx tsx check-root-account-mfa-and-access-keys.ts --org --days=30

Account 111122223333 root user (arn:aws:iam::111122223333:root)
┌─────────┬─────────────────────────────┬─────────────────────────────────────────────────────────┬────────────┐
│ (index) │ Check                       │ Result                                                  │ Severity   │
├─────────┼─────────────────────────────┼─────────────────────────────────────────────────────────┼────────────┤
│ 0       │ 'Root MFA'                  │ 'enabled (a virtual MFA device is assigned)'            │ 'INFO'     │
│ 1       │ 'Root access key 1'         │ 'ACTIVE, created 2019-03-14, last used 2026-08-30 (s3)' │ 'CRITICAL' │
│ 2       │ 'Root signing certificates' │ 'none'                                                  │ 'OK'       │
│ 3       │ 'Root password'             │ 'present, last used 2026-09-02 (26 days ago)'           │ 'MEDIUM'   │
└─────────┴─────────────────────────────┴─────────────────────────────────────────────────────────┴────────────┘
1 CRITICAL/HIGH finding(s). Root sign-ins within 90 days are flagged MEDIUM.