IAM root user access key should not exist

How to fix it

Have the account report no access keys for the root user. Root keys live only on the root user's own security credentials page, so removing one means acting as the root user itself; the root user is not listed under IAM Users and no IAM API deletes a root key for a caller that is not root. Deactivating a key first is reversible and shows what still depends on it, deleting is not, and anything still signing requests with that key loses access the moment it is deactivated, so move that workload onto an IAM role or IAM Identity Center before touching the key. For a member account of an organization that has centralized root access, the management account or delegated IAM administrator can remove the member's root credentials instead, without the member's root password: that also removes the root password, signing certificates and MFA, and leaves account recovery to the organization. An account with no root credentials also satisfies the two root-MFA controls.

In the console

As the root user: the account name menu at top right → Security credentials → Access keys