A new AWS account has been created and root-user use should be minimized.
The team must protect the identity with the broadest account privileges.
Which action helps protect the root user?
The root user has powerful account-level permissions. Protect it with MFA and avoid using it for routine work.
Detailed explanation
Sharing removes individual accountability and expands the exposure of the most powerful credential.
Sharing removes individual accountability and expands the exposure of the most powerful credential.
MFA adds protection to the highly privileged root identity, and routine work should use a separately controlled identity.
MFA adds protection to the highly privileged root identity, and routine work should use a separately controlled identity.
Routine work should use least-privileged users, roles, or IAM Identity Center rather than the root user.
Routine work should use least-privileged users, roles, or IAM Identity Center rather than the root user.
A root access key is a powerful long-term credential whose exposure could compromise the entire account.
A root access key is a powerful long-term credential whose exposure could compromise the entire account.
Check official documentation
Compare the following points with the official documentation.
IAM User GuideのRoot user best practicesとroot user MFAの説明を確認する。
What to confirm
rootユーザーにMFAを設定し、日常作業は管理用の別の主体で実行する。
Key points
- Root user
- MFA
- Avoid long-term access keys
Notes
- Environment: AWS公式IAMドキュメントのアカウント保護確認
- Confirm current IAM capabilities and recommended practices in the official AWS documentation.
Foundation review
Privileged identity
The root user should be protected with MFA and used only when a root-only task requires it.
Routine access
Daily administration is safer with scoped users, roles, or IAM Identity Center.