Contents
Which of the following strategies helps protect your AWS root account?
Eliminate the use of root access keys. Instead, rotate them to IAM access keys, and then delete the root access keys. Use an MFA device for the root user of your account.
How do I manage AWS security?
Best practices to help secure your AWS resources
- Create a strong password for your AWS resources.
- Use a group email alias with your AWS account.
- Enable multi-factor authentication.
- Set up AWS IAM users, groups, and roles for daily account access.
- Delete your account’s access keys.
- Enable CloudTrail in all AWS regions.
How to create access key for AWS root user?
You can use the AWS Management Console or AWS programming tools to create access keys for the root user. To create an access key for the AWS account root user (console) Sign in to the IAM console as the account owner by choosing Root user and entering your AWS account email address. On the next page, enter your password.
Which is the best practice for managing AWS access keys?
Unless you must have root user access keys (which is rare), it is best not to generate them. Instead, the recommended best practice is to create one or more AWS Identity and Access Management (IAM) users. Grant those IAM users the necessary permissions and use them for everyday interaction with AWS.
Can you restrict the permissions for your AWS root user?
You cannot restrict the permissions for your AWS account root user. One of the best ways to protect your account is to not have an access key for your AWS account root user. Unless you must have a root user access key (which is very rare), it is best not to generate one.
What to do if AWS access key is deactivated?
The CloudTrail log shows the IP address of the caller and the access key (obscured in the screenshot), and you can use these to take further actions—potentially by opening a trouble ticket at your company or by deactivating or deleting the access key for your root account.