---
title: '''root'' account access should be monitored'
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > 'root' account access should be
  monitored
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# 'root' account access should be monitored
 
## Description{% #description %}

AWS accounts should have at least one active multi-region CloudTrail trail that captures all management events (`IncludeManagementEvents` set to true and `ReadWriteType` set to `All`), sends its logs to CloudWatch Logs, and has a metric filter for root account usage (`{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }`) with an associated CloudWatch alarm. The alarm must notify an SNS topic that has at least one confirmed subscriber, providing visibility into use of the fully privileged root account.

## Remediation{% #remediation %}

1. Create a metric filter on the log group of the active multi-region trail using the root usage pattern, then create an SNS topic with at least one subscription, following the [AWS CloudWatch Alarms for CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html):

```plaintext
aws logs put-metric-filter --log-group-name <trail-log-group-name> \
--filter-name <root-usage-metric> --metric-transformations \
metricName=<root-usage-metric>,metricNamespace='CISBenchmark',metricValue=1 \
--filter-pattern '{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }'
aws sns create-topic --name <sns-topic-name>
aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints>
```
Create an alarm associated with the metric filter that notifies the SNS topic, as described in [Subscribing an endpoint to an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.html) and the [CloudWatch alarms guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html):
```plaintext
aws cloudwatch put-metric-alarm --alarm-name <root-usage-alarm> --metric-name <root-usage-metric> \
--statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \
--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn>
```

## References{% #references %}

- [Subscribing an endpoint to an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.html)
- [Receiving CloudTrail log files from multiple Regions](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)