All checks
Critical
Hardware MFA should be enabled for the root user
Verifies that the root user's MFA is a hardware device (a passkey or security key, or a hardware TOTP token), since an authenticator app may not give the same protection. It fails when the root user has no MFA device, or has any virtual one, even alongside a hardware device, because AWS lets root hold several.
- service
- IAM
- severity
- Critical
- scope
- evaluated once per account
How to fix it
In the console
As the root user: the account name menu at top right → Security credentials → Multi-factor authentication (MFA)
See which of your accounts this check is failing on.
Book a demo