The AWS root user should be protected with a hardware MFA device

The root user can do things no other identity can, and its powers cannot all be limited by policy. An authenticator app on a phone is a good second factor, but the phone can be lost, cloned or compromised along with the app's secret. A physical device is harder to copy and ties the root user to something that can be locked away.

AWS describes the supported MFA types for the root user, including security keys and hardware tokens, on the pages listed under sources.

Sign in as the root user, open Security credentials from the account menu, and look at the type of the registered MFA device. From the command line, first confirm that MFA is on, then see whether the root user's device is a virtual one:

aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'
aws iam list-virtual-mfa-devices --assignment-status Assigned \
  --query 'VirtualMFADevices[].SerialNumber'

If the first command returns 1 and the list contains a serial ending in mfa/root-account-mfa-device, the root user uses a virtual (app-based) device. Both commands only read account information.

Register a physical device for the root user:

• Obtain a hardware TOTP token or a FIDO security key and decide who will store it.
• Sign in to the console as the root user and open Security credentials.
• Remove or replace the virtual device, or add the physical one, following the Assign MFA device flow.
• Sign out and back in to confirm the new device is requested.

This is a console task; there is no CLI script for the root user. ConfigCobra only reports the state and never changes your AWS account.

Only the people who sign in as the root user are affected, and they will need the physical device in hand. Decide where it is kept and who can reach it during an emergency, and consider whether a second registered device is appropriate so the account does not depend on a single object.

Applications, IAM users and roles are not affected. The cost is a small purchase and a short storage procedure for the device. Write down the procedure for retrieving it, test it once while nobody is under pressure, and review who holds the device whenever the people responsible for the account change.