The AWS root user should be protected with multi-factor authentication

The root user is the identity created with the account. It can do things no other identity can, such as closing the account or changing the support plan, and some of its powers cannot be limited by IAM policies. If someone obtains the root password through phishing or a leaked password list, nothing else stands between them and everything in the account.

AWS's own guidance for the root user is to protect it with MFA and to keep it out of daily use. The pages listed under sources describe the root user and how to enable MFA for it.

Sign in to the AWS console and open IAM. The dashboard shows a security recommendation if the root user has no MFA. From the command line, with credentials that can read IAM, the account summary reports it directly:

aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'

A result of 1 means the root user has MFA; 0 means it does not. The command only reads account information.

Registering root MFA must be done while signed in as the root user:

• Sign in to the console as the root user with the account email address.
• Open the account menu in the top right and choose Security credentials.
• In the Multi-factor authentication section, choose Assign MFA device, give it a name, and pick an authenticator app, a security key or a hardware token.
• Complete the on-screen steps and sign out, then sign in again to confirm the prompt appears.

There is no command-line step for this because the root user is not normally used with the CLI. ConfigCobra only reports the state of this setting; it never changes your AWS account.

Anyone who signs in as the root user will be asked for the second factor from then on. That is usually only one or two people, such as the account owner and a break-glass holder. Agree in advance who keeps the device and where the recovery details live, because losing the device without a recovery route can lock the team out of root-only tasks.

IAM users, roles and automation are not affected, since they do not use the root credentials. Day-to-day work continues unchanged.