Suspicious activity

API access from Root account was detected

Platform(s)

Description

Orca detected API access from Root account. This action may indicate of a presence of an unauthorized actor in the cloud environment, since root account should not be used on daily basis. In case this is a legit action then the root account should not be used in day to day administrative tasks because it can't be deleted and its permissions can't be revoked. If its credentials will be stolen the entire account is at risk.
  • Recommended Mitigation

    It is recommended to review the root account activity and eliminate the use of the root account by creating individual users with set permissions.