---
title: The 'root' account should not be used for daily tasks
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The 'root' account should not be used
  for daily tasks
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The 'root' account should not be used for daily tasks
 
## Description{% #description %}

AWS root user credentials should not be used for daily tasks. Every AWS account has a root user with unrestricted access to all resources, so routine use of it violates least privilege and increases the risk of accidental changes or full account compromise. This rule reviews the root user's entry in the IAM credential report. It fails if the root password, access key 1, or access key 2 was used within the last 30 days, or if the root password is enabled while MFA is not active. If the credential report includes the root password status, that status is used. Otherwise, the account summary (`AccountPasswordPresent`) determines whether a root password exists.

## Remediation{% #remediation %}

Stop using the root user for routine operations, and use IAM roles or users with least privilege instead. Deactivate or delete any root access keys. Then either enable MFA for the root user or remove the root password, as described in [AWS root user best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html).

## References{% #references %}

- [Getting credential reports for your AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)
- [Enable a virtual MFA device for the AWS account root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-virt-mfa-for-root.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)