We discover our AWS root account has no MFA

Root without MFA is not a minor housekeeping item, that is a full-red incident. Anyone with that password can charge unlimited spend to your card.

Try this first

1. 1Stop other work. MFA on root first: sign in as root, go to IAM > Security credentials > Multi-factor authentication, register a hardware key or a TOTP app on a phone that is not solely on one admin.
2. 2Store the MFA recovery codes in a vault several people can access. One person with root-MFA on only their personal phone is your next incident.
3. 3Rotate the root password right after enabling MFA. Was it written somewhere in a wiki or mail? Assume it leaked, do not hope.
4. 4Enable CloudTrail in every region and review the last thirty days for root login events. Unknown IPs or regions: you are breached and this becomes a data-incident question, not an IT one.
5. 5Set a policy that root is not used for day-to-day work from now on. Create admin users in IAM Identity Center, vault root, only use it for things only root can do (close account, change support plan).

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.