MFA should be enabled for the root user
Confirms that MFA is enabled for the root user. Any device type clears this control; IAM.6 is the one that requires a hardware device.
- service
- IAM
- severity
- Critical
- scope
- evaluated once per account
How to fix it
Have at least one MFA device assigned to the root user. Any kind counts here, an authenticator app registered as a virtual MFA device included, which is the whole difference between this control and the hardware one: what clears this can leave that one failing. Enrolment is a console-only action performed as the root user; no IAM API registers an MFA device for root. Once a device is enrolled every root sign-in needs it, and losing the last one means recovering the account through AWS Support, so enrol a second device while the first is to hand.
In the console
As the root user: the account name menu at top right → Security credentials → Multi-factor authentication (MFA)
See which of your accounts this check is failing on.
Book a demo