☁ AWS · IAM & Identity · AWS-01

Root Account MFA Status

CIS AWS Foundations Benchmark v2.0 · Control 1.4 | Maps to: NIST CSF PR.AC-7 · SOX ITGC AC-01 · PCI DSS 8.5 · FFIEC CAT · ISO 27001 A.9.4

Risk if failing

CRITICAL

Audit frequency

Every engagement

Script runtime

< 5 seconds

Failure risk rating

Critical — full account takeover risk. Immediate remediation required.

What this tests

Whether multi-factor authentication is enabled on the AWS root account. The root account has unrestricted access to every resource in your AWS environment — it bypasses all IAM policies, SCPs, and permission boundaries. Without MFA, a stolen password is a stolen account.

This check queries AWS IAM's account summary endpoint and evaluates a single field: AccountMFAEnabled. Either it is 1 (MFA active) or it is 0 (no MFA, immediate critical finding).

Why this matters in audit

Root account compromise appears in every major cloud breach post-mortem. Unlike an IAM user where you can restrict permissions, root cannot be constrained — it owns the account. A single exposed credential without MFA means complete data loss, infrastructure destruction, or ransomware deployment are one login away.

Every audit framework that touches cloud infrastructure lists root MFA as a mandatory or priority-one control. SOX ITGC programmes treat it as a general computer control failure that escalates to the external auditor. PCI DSS 8.5 explicitly requires MFA for all non-consumer accounts with admin access. A FAIL here is not a finding that stays in the IT audit report — it surfaces at the board level.

Pass and fail criteria

PASS — AccountMFAEnabled = 1. Virtual or hardware MFA device is active on the root account. No finding.

FAIL — CRITICAL — AccountMFAEnabled = 0. No MFA device registered. Root account accessible with password alone. Raise immediately.

WARN — Script cannot connect or IAM credentials lack iam:GetAccountSummary permission. Finding scope limited — escalate access or document limitation.

// Evidence this produces

Sample PASS output — JSON

{
  "check_id":          "AWS-01",
  "check_name":        "Root Account MFA Status",
  "cis_reference":     "CIS AWS Foundations v2.0 — Control 1.4",
  "regulation_map":    "NIST CSF PR.AC-7 | SOX ITGC AC-01 | PCI DSS 8.5 | ISO 27001 A.9.4",
  "account_id":        "123456789012",
  "timestamp":         "2026-03-02T14:32:07Z",
  "result":            "PASS",
  "finding":           "Root account MFA is enabled.",
  "risk_rating":       "N/A",
  "remediation":       "None required.",
  "raw": { "AccountMFAEnabled": 1 }
}

Sample FAIL output — JSON

{
  "check_id":          "AWS-01",
  "check_name":        "Root Account MFA Status",
  "cis_reference":     "CIS AWS Foundations v2.0 — Control 1.4",
  "regulation_map":    "NIST CSF PR.AC-7 | SOX ITGC AC-01 | PCI DSS 8.5 | ISO 27001 A.9.4",
  "account_id":        "123456789012",
  "timestamp":         "2026-03-02T14:32:07Z",
  "result":            "FAIL",
  "risk_rating":       "CRITICAL",
  "finding":           "Root account MFA is NOT enabled. Full account access requires only a password.",
  "remediation":       "Enable virtual or hardware MFA on root account immediately via IAM console.",
  "raw": { "AccountMFAEnabled": 0 }
}

// Regulation cross-reference

Regulation

Clause / Control

Obligation

NIST CSF 2.0

PR.AC-7 — Authentication

Users and devices are authenticated commensurate with risk

SOX ITGC

AC-01 — Logical Access

Privileged accounts require strong authentication controls

PCI DSS v4.0

Req 8.5 — MFA for all access

MFA required for all non-consumer accounts into the CDE and admin access

ISO 27001:2022

A.9.4 — System access control

Secure log-on procedures and authentication management for privileged access

FFIEC CAT

Access Management — Baseline

Multi-factor authentication for privileged user accounts is a baseline maturity requirement

DORA (EU)

Art. 9 — ICT security policies

Strong authentication mechanisms required for privileged account access

Remediation

Navigate to the top-right account menu → Security credentials.

Under Multi-factor authentication (MFA), click Assign MFA device.

Select Virtual MFA device (Authenticator app) or Hardware TOTP token. Hardware is preferred for root — it cannot be phished remotely.

Complete device registration. Re-run AWS-01 script to confirm AccountMFAEnabled = 1 and attach PASS output to remediation evidence.

▶ Run the Python script

boto3 · live sandbox · JSON + terminal output · <5s runtime · workpaper-ready evidence

Python Encounters → AWS-01

← Back to Theatre AWS-02: Root Access Keys →