c1.5 Protect the root account

Avoid using root

The root user has unrestricted access and cannot be constrained by IAM policies, so use it only for the few tasks that truly require it. For everything else use federated, least-privilege access from a centralized identity source. Never create access keys for root — they are durable, unrestricted credentials.

Centrally manage or remove root on member accounts

With AWS Organizations you can centrally manage root access: remove the root user credentials from member accounts entirely, and perform the rare privileged root tasks centrally when needed. This means you only have one root user (the management account) to protect instead of one per account — a large reduction in privileged attack surface. Alternatively, deny root actions on member accounts with AWS Control Tower or an SCP such as:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RestrictRootOnMemberAccounts",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": { "StringLike": { "aws:PrincipalArn": ["arn:aws:iam::*:root"] } }
    }
  ]
}

Protect the root you keep

The management account root is not subject to SCPs, so it needs the strongest protection:

• Enable MFA (now required) — prefer a hardware/FIDO2 device and consider two-person control (one knows the password, another holds the MFA device).
• Never attach access keys to root.
• Alert on every root sign-in (CloudTrail to an SNS notification), since root use should be rare and deliberate.
• Keep the account security contacts current to preserve the recovery path.