SignalHunt
← All rules

AWS-3002

critical

AWS Root Account Usage

Detects any API call or console login made using the AWS account root user, which should never be used for day-to-day activity per the CIS AWS Foundations Benchmark.

T1078.004

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "userIdentity.type": "Root"
  }
}

Log source: category=cloudtrail, product=aws · Event ID(s): *

Required log fields

  • eventName
  • sourceIPAddress
  • userIdentity.accountId
  • userIdentity.arn

Enabling this in your environment

Where: CloudTrail trail + CloudWatch metric filter/alarm

aws cloudwatch put-metric-alarm --alarm-name root-account-usage --metric-name RootAccountUsageCount --namespace CISBenchmark --statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold

Requires a CloudTrail trail with management events + a CloudWatch Logs metric filter pattern '{ $.userIdentity.type = "Root" }' feeding this alarm - CloudTrail alone only gets you the log, not the alert.

False positives

  • Rare legitimate break-glass root usage - should always be a tracked, ticketed event

References