UXDL Docs
Security

Root User Protection

Retire the AWS root user with SAML SSO, temporary credentials, and MFA.

The AWS root user has unrestricted access to every service and resource in an account. Because the root user cannot be restricted by IAM policies, protecting it and minimizing its use is critical. We retire the root user from daily operations and authenticate administrators through a corporate Identity Provider instead.

Objective

  • Eliminate routine use of the AWS root user.
  • Prevent unauthorized use of permanent root credentials.
  • Enforce passwordless Single Sign-On (SSO) for administrators.
  • Require Multi-Factor Authentication (MFA) through the enterprise Identity Provider.
  • Provide temporary, role-based AWS access.
  • Improve security, auditing, and compliance.

Why the root user is dangerous

Since the root user cannot be constrained by IAM policies, the only effective mitigations are to stop using it and to lock it down for emergency access only.

Solution

Instead of using the root user:

  • Configure a SAML 2.0 Identity Provider (such as Microsoft Entra ID, Okta, Google Workspace, or Ping Identity).
  • Integrate the Identity Provider with AWS IAM Identity Center or AWS IAM SAML Federation.
  • Assign IAM roles to administrators based on their responsibilities.
  • Authenticate users through the corporate Identity Provider.
  • Grant temporary AWS credentials using AWS Security Token Service (STS).
  • Keep the root account for emergency ("break-glass") use only.

Architecture

Authentication flow

  1. The administrator accesses the corporate Identity Provider.
  2. The user authenticates using passwordless authentication and MFA.
  3. The Identity Provider generates a signed SAML assertion.
  4. AWS validates the SAML assertion.
  5. The user assumes the assigned IAM role.
  6. AWS STS issues temporary credentials.
  7. The administrator accesses AWS resources within the role's permissions.

The AWS root user is not used at any point during normal operations.

Locking down the root account

To further secure the root account for its rare break-glass role:

  • Enable MFA on the root user.
  • Remove the root password from operational use — never use it for daily administration.
  • Do not create root access keys.
  • Store root credentials in a protected vault for emergency access only.
  • Monitor root activity using AWS CloudTrail and Amazon CloudWatch.
  • Alert on any root sign-in or API activity.