How should you protect and use the AWS account root user?
Enable MFA on the root user, do not create access keys for it, and use it only for the few tasks that need it. For daily work use IAM Identity Center or IAM users and roles with least privilege.
Explain it simply
The root user is the owner's master key to the whole building, including the vault. You would not carry it around daily. You keep it locked in a safe with a second lock (MFA), and give staff keys limited to their rooms.
Example
Do
- Set a strong, unique password and enable MFA (a hardware key is best)
- Use a shared mailbox you control as the root email, not one person's inbox
- Create an admin identity with IAM Identity Center or an IAM role
- Set up billing alerts and review CloudTrail
Do not
- Create or keep access keys for root
- Use root for routine work
- Share the root password in chat
Tasks that still need root (examples)
- Change account settings, root email or support plan
- Close the AWS account
- Restore IAM permissions if everyone is locked outRoot has unrestricted access that cannot be limited by IAM policies, though service control policies in AWS Organizations can restrict root in member accounts.
After the first sign-in, set up the root MFA and then work as a less privileged identity.
What to say in the interview
"I put MFA on the root user, remove any access keys, lock the credentials away and use it only for rare account-level tasks. Daily work goes through IAM Identity Center or roles with least privilege."
Common mistakes
- Leaving root access keys active.