Suspicious activity

AWS root profile created access key

Risk Level

Informational (4)



Orca detected that the root profile was used to create a new AWS access key. This action may indicate of a presence of an unauthorized actor in the cloud environment, since creating new access keys usually are not made from the root account profile. The root account should not be used in day to day administrative tasks because it can't be deleted and its permissions can't be revoked. If its credentials will be stolen the entire account is at risk.
  • Recommended Mitigation

    It is recommended to review the root account activity and eliminate the use of the root account for creating access keys with set permissions.