How to Secure the AWS Account Root User

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Create IAM users for daily administrative tasks and enable multi-factor authentication on the root user.

Question

A company has established a new AWS account. The account is newly provisioned and no changes have been made to the default settings. The company is concerned about the security of the AWS account root user. What should be done to secure the root user?
  1. Create IAM users for daily administrative tasks. Disable the root user.
  2. Create IAM users for daily administrative tasks. Enable multi-factor authentication on the root user. Correct Answer
  3. Generate an access key for the root user. Use the access key for daily administration tasks instead of the AWS Management Console.
  4. Provide the root user credentials to the most senior solutions architect. Have the solutions architect use the root user for daily administration tasks.

Key Takeaways

This question tests AWS root user security best practices, where the common trap is assuming the root user can be disabled or that its access keys should be used for daily administration.

Securing the AWS account root user is a critical first step in a newly provisioned account. This page establishes that creating IAM users for daily tasks and enabling MFA on the root user is the required approach.

Common mistake: Choosing A is a common mistake because users assume the root user can be disabled, but AWS does not allow disabling the root user.

Expert Analysis

Why the Answer Is Correct

Option B is correct because AWS security best practices strictly dictate that you should not use the root user for daily administrative tasks; instead, you must create IAM users for those tasks. Furthermore, enabling multi-factor authentication (MFA) on the root user is the most critical step to protect it from unauthorized access.

Why the Other Options Are Wrong

Option A is incorrect because you cannot disable the AWS account root user; it is a permanent entity that always exists within an account. Option C is incorrect because generating and using access keys for the root user for daily tasks severely violates security best practices and increases the risk of credential exposure. Option D is incorrect because sharing root user credentials and using them for daily administration violates the principle of least privilege and separation of duties.

Community Comment Notes

Commenters emphasize that root access must never be used for routine operational activities due to the principle of separation of duties. As BillaRanga noted, "do not use the AWS account root user for any task where it's not required." Naveena_Devanga also highlighted that root access must never be used for routine activities to prevent security incidents.

Official Reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Remember that the AWS account root user cannot be disabled or deleted. Always select options that enforce MFA on the root user and delegate daily tasks to IAM users with least privilege.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. BillaRanga 👍 11 Answered B
    "As a best practice, do not use the AWS account root user for any task where it's not required. Instead, create a new IAM user for each person that requires administrator access." It's B :)
  2. d401c0d 👍 2 Answered B
    D is just killing me. If we have reached this far, we all know it is Option B - "As a best practice, do not use the AWS account root user for any task where it's not required. Instead, create a new IAM user for each person that requires administrator access."
  3. Naveena_Devanga 👍 2
    Segregation of roles, also known as separation of duties (SoD), is a business control that helps prevent security or privacy incidents and errors. Therefore, root access must never used for routine operational activities.
  4. Andy_09 👍 8
    Option B
  5. Sivaeas 👍 3 Answered B
    its option B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide