Which tasks require use of the AWS account root user? (Select TWO.)

The AWS account root user has unrestricted access to all resources in the account. For security, AWS restricts certain sensitive, account-level actions to only be performed by this user. These tasks include changing the AWS Support plan, modifying root user credentials, and closing an AWS account. AWS best practices strongly recommend creating and using AWS Identity and Access Management (IAM) users with specific, limited permissions for all routine administrative and operational tasks.

B. Modifying an Amazon EC2 instance type is a standard operational task that can and should be delegated to an IAM user with appropriate permissions.
C. Grouping resources in AWS Systems Manager is an organizational task that can be performed by an IAM user with the necessary permissions.
D. Running applications in Amazon EKS is an operational workload management task that should be performed by an IAM user or role, not the root user.

1. AWS Identity and Access Management User Guide. (2023). Tasks that require root user credentials. AWS Documentation. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html. (This page explicitly lists "Change your AWS Support plan" and "Close your AWS account" as tasks requiring the root user.)

2. AWS Identity and Access Management User Guide. (2023). Security best practices in IAM. AWS Documentation. Retrieved from https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#lock-away-credentials. (This section advises locking away root user credentials and not using them for everyday tasks.)