---
title: MFA should be enabled for the 'root' account
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > MFA should be enabled for the 'root'
  account
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# MFA should be enabled for the 'root' account
 
## Description{% #description %}

AWS root accounts should have multi-factor authentication (MFA) enabled, or have no console password configured. The root account is the most privileged user in an AWS account, and without MFA it is highly susceptible to compromise, potentially resulting in full account takeover. This rule passes when `AccountMFAEnabled` is `1` or `AccountPasswordPresent` is `0` (for example, when Centralized Root Management has removed the root password); it is skipped for GovCloud (US) accounts, whose root user does not have console access.

## Remediation{% #remediation %}

Sign in with the root user credentials, open **Security credentials**, and assign a virtual MFA device to the root user as described in [Enable a virtual MFA device for the root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-virt-mfa-for-root.html). MFA for the root account cannot be managed using IAM users or roles.

## References{% #references %}

- [AWS IAM credential reports](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)
- [AWS IAM GetAccountSummary API](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)