How to Create an Access Key for the Root User in AWS (And Why You Should Minimize Its Use)

This article is based on guidance originally sourced from TechRepublic. It has been rewritten and expanded for a DevOps engineering audience.

Why Root User Access Keys Are a Security Risk

Every AWS account has a root user — the original identity created when you first register with Amazon Web Services. The root user has unrestricted access to every resource and service within the account, bypassing any IAM policies or permission boundaries. If root user credentials are compromised, an attacker has complete control over your infrastructure, billing, and data.

AWS best practices strongly discourage using root user credentials for everyday operational tasks. Instead, you should:

• Create an IAM user with administrative privileges for day-to-day work.
• Enable multi-factor authentication (MFA) on the root account.
• Avoid creating long-lived root access keys unless absolutely necessary.
• Rotate or delete any existing root access keys that are no longer needed.

That said, there are edge-case scenarios where a root access key is required — for example, certain account-level API calls that only the root user can make. In those cases, the safest approach is to generate a new access key, perform the required task, and then immediately delete the key.

Two Complementary Strategies for Securing Root Access

Securing high-level AWS access effectively involves combining two approaches:

1. Create an administrative IAM user and group. Grant this IAM user full administrative privileges via an attached policy (such as AdministratorAccess). Use this identity for all routine administrative work instead of logging in as root.
2. Rotate or delete root access keys. Generate new access keys for the root user if required, then delete the old keys. If no root API access is needed at all, delete all root access keys entirely — this is the AWS-recommended state.

How to Create an Access Key for the AWS Root User

Follow these steps to create a new access key using the AWS Management Console. Note that you must be logged in as the root user to complete this process.

Step 1: Log in as the Root User

Navigate to the AWS Management Console. On the sign-in page, choose Root user and enter the email address associated with your AWS account, then enter your root password.

If you normally sign in with an IAM user, look for the option to switch to the root user sign-in method on the login screen.

Step 2: Open Security Credentials

Once logged in, click your account name or alias in the top-right navigation bar. A dropdown menu will appear. Select Security credentials (previously labelled My Security Credentials in older console versions).

Step 3: Navigate to Access Keys

On the Security credentials page, scroll down to the Access keys section. This section displays any existing access keys associated with the root user, along with their status (active or inactive) and the date they were last used.

Step 4: Create a New Access Key

Click the Create access key button. AWS will generate a new Access Key ID and Secret Access Key pair. You will see both values displayed on screen.

Important: The Secret Access Key is only shown once. Copy it immediately and store it securely (for example, in a secrets manager or encrypted vault). If you lose it, you cannot retrieve it — you will need to create a new key pair.

You can also download the key pair as a .csv file using the provided option on the same screen.

Step 5: Delete the Old Access Key

After confirming your new access key works as expected (by making a test API call), return to the Access keys section and delete the old key. Select the old key and click Delete. AWS will ask you to confirm by typing the word delete or the key ID — follow the prompt.

If you are unsure whether the old key is still in use by any automated processes, you can first set it to Inactive rather than deleting it immediately. Monitor for failures, then delete once you are confident nothing depends on the old key.

Best Practice: Delete All Root Access Keys

AWS explicitly recommends that most accounts should have no root access keys at all. Nearly every administrative task can be performed by an IAM user or role with appropriate permissions. Removing root access keys entirely eliminates a significant attack surface.

Use the IAM dashboard in the AWS Console to check your account’s security status. A green check mark next to No root access keys confirms you are following this best practice.

Combining Root Key Rotation with IAM User Setup

For a complete security hardening approach, pair root key rotation with the following IAM steps:

• Create an IAM user with the AdministratorAccess managed policy attached.
• Create an IAM group (e.g., Administrators) with the policy attached at the group level, then add the IAM user to that group.
• Enable MFA on both the root account and any IAM user with elevated privileges.
• Use IAM roles for programmatic access from services, Lambda functions, EC2 instances, and CI/CD pipelines — avoid embedding long-lived access keys in application code or configuration files.

Summary

Creating and rotating root user access keys in AWS is a straightforward process through the Security Credentials page in the Management Console. However, the most secure posture is to avoid root access keys altogether. Use IAM users, groups, and roles for all operational access, enable MFA on the root account, and treat the root user as a break-glass emergency identity only.

For further reading, refer to the official AWS documentation on root user best practices.