AWS Certified Cloud Practitioner (CLF-C02)Security and ComplianceEasy
A newly hired administrator logs into the AWS Management Console for the first time using the account's root user credentials. Which action reflects AWS best practice for handling this account going forward?
- AEnable MFA on the root user, then create individual IAM users with appropriate permissions for daily work
- BShare the root user password with the rest of the team by email for convenience
- CDelete the root user account immediately after logging in once
- DUse the root user for all daily administrative tasks going forward
Show answer & explanationAnswer & explanation
Correct answer: A. Enable MFA on the root user, then create individual IAM users with appropriate permissions for daily work
AWS best practice is to secure the root user with MFA, avoid using it for routine tasks, and create individual IAM identities for daily administration. The root user cannot be deleted, and sharing credentials violates security best practices.
Why the other options are wrong
- B. Sharing root credentials creates major security risk and violates least privilege.
- C. The root user account cannot be deleted from an AWS account.
- D. Root should be reserved for account-level tasks only, not daily use.
Root User Protection
The AWS account root user has unrestricted access and should be secured with MFA and reserved for account/billing tasks, with IAM users/roles used for daily work.
- Enable MFA on root immediately after account creation
- Do not create access keys for root unless absolutely necessary
- Use IAM users, groups, and roles for everyday administrative tasks
Memory trick: Lock the root, hand out IAM keys instead