Description

Orca detected that a Root profile was used to list S3 objects. This action may indicate of a presence of an unauthorized actor in the cloud environment, since listing S3 buckets usually are not made from the root account profile. Furthermore, listing objects is a common enumeration action attackers conduct in the reconnaissance phase. The root account should not be used in day to day administrative tasks because it can't be deleted and its permissions can't be revoked. If its credentials will be stolen the entire account is at risk.