---
title: Access keys granting 'root' should be removed
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Access keys granting 'root' should be
  removed
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Access keys granting 'root' should be removed
 
## Description{% #description %}

AWS IAM accounts should have no access keys for the root user. Root access keys provide unrestricted programmatic access with no built-in scope limitations, which significantly increases the risk of account compromise. This rule checks the account summary's `AccountAccessKeysPresent` value and passes only when it is `0`. Inactive keys still count as present, so keys must be deleted rather than deactivated to pass.

## Remediation{% #remediation %}

1. Sign in to the AWS Management Console as the root user, open **Security credentials** from the account menu, and go to **Access keys**. For more information, see [Delete access keys for the root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user_manage_delete-key.html).
1. For each key, deactivate it under **Status** and then click **Delete**. Deleted keys cannot be recovered.

## References{% #references %}

- [AWS IAM credential reports](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)
- [AWS IAM API Reference: GetAccountSummary](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)