No Root Access Keys
| Property | |
|---|---|
| Language |  |
| Severity |  |
| Service | iam |
| Provider | AWS |
Description#
AWS access keys are assigned to the root user, allowing programmatic access with unrestricted permissions. This practice exposes the entire AWS account to risk if the credentials are leaked or compromised.
Impact#
If the root user’s access keys are compromised, an attacker gains full control over all AWS resources, enabling actions such as data theft, service disruption, or complete account takeover. This can lead to severe data loss, financial impact, and reputational damage.
Resolution#
Use lower privileged accounts instead, so only required privileges are available.