---
title: The 'root' user account should use hardware-based MFA
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The 'root' user account should use
  hardware-based MFA
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The 'root' user account should use hardware-based MFA
 
## Description{% #description %}

AWS IAM accounts should protect the root user with a hardware MFA device, which has a smaller attack surface than a virtual MFA device residing on a mobile device. The rule verifies that root MFA is enabled (`AccountMFAEnabled` is 1) and that no virtual MFA device is assigned to the root user (a serial number such as `arn:aws:iam::<account_id>:mfa/root-account-mfa-device`). If managing a single hardware MFA across many AWS accounts is challenging, consider applying this recommendation selectively to the highest-security accounts.

Accounts whose root password and access keys have been removed through [centralized root access management](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html) are skipped, because root MFA cannot be configured on them and is not required.

## Remediation{% #remediation %}

Sign in to the AWS Management Console as the root user, open **Security credentials**, and under **Multi-factor authentication (MFA)** remove any assigned virtual MFA device. Then choose **Assign MFA device**, select **Security key** or **Hardware TOTP token**, and follow the prompts to complete assignment as described in [Enabling a hardware MFA device for the root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-hw-mfa-for-root.html).

## References{% #references %}

- [AWS multi-factor authentication in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html)
- [Centralized root access management for member accounts](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)