Suspicious activity

Root profile was used to describe EC2 instances

Risk Level

Informational (4)

  • N/A


It has been found that a Root profile was used to describe EC2 instances. Listing EC2 instances is a common enumeration action attackers conduct in the reconnaissance phase. The root account should not be used in day to day administrative tasks because it can't be deleted and its permissions can't be revoked. If its credentials will be stolen the entire account is at risk.
  • Recommended Mitigation

    It is recommended to review the root account activity and eliminate the use of the root account by creating individual users with set permissions.