False positive for AWS "Root Account without MFA"
Author: moleksyukCreated Jul 2, 2025Updated Nov 19, 2025
Labelsbugpotential
Describe the bug
Please provide: ScoutSuite gives false positive result for "Root Account without MFA" if you are using AWS Organization and have disabled root access completely by the best security practices from AWS via "Centrally managing root access for customers using AWS Organizations"
To Reproduce
- Create AWS organization
- Add child account
- Disable root access completely following this AWS guide - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html
- Run scoutsuite agains a child account.
Please provide:
- The exact CLI parameters used to run Scout Suite.
- Any specific configuration within the cloud account which might have lead to the issue.
Nothing specific here, just: python scout.py aws -r <region>
Source: nccgroup/ScoutSuite