A company has established a new AWS account. The account is newly provisioned and no changes have been made to the default settings. The company is…

AWS security best practices strongly recommend securing the AWS account root user by enabling Multi-Factor Authentication (MFA). The root user has unrestricted access to all resources in the account and should not be used for daily administrative tasks. Instead, individual IAM users with the minimum necessary permissions (the principle of least privilege) should be created for all human and programmatic access. This dual approach of locking down the root user with MFA and delegating daily tasks to IAM users is a foundational security measure for any AWS account.

A. The AWS account root user cannot be disabled. It is required for a small number of specific account and service management tasks.

C. Creating and using root user access keys is strongly discouraged. If compromised, these keys provide unrestricted programmatic access to the entire account.

D. Using the root user for daily tasks, even by a senior architect, violates security best practices and the principle of least privilege.

1. AWS Identity and Access Management User Guide: In the "Security best practices in IAM" section

AWS states

"We strongly recommend that you enable multi-factor authentication (MFA) on your root user." It also advises

"Don't use the root user for your everyday tasks

even the administrative ones. Instead

create an IAM user for each person who needs administrative access." (See section: "Security best practices in IAM").

2. AWS Security Best Practices Whitepaper: This document outlines foundational best practices. In the section "Secure your AWS account root user

" it explicitly recommends: "Enable multi-factor authentication (MFA) for the root user" and "Do not use the root user for day-to-day operations." (aws-security-best-practices.pdf

Page 8).

3. AWS Identity and Access Management User Guide: The guide lists specific "Tasks that require root user credentials

" such as changing account settings or closing an AWS account. This demonstrates that the root user has unique functions and cannot be disabled. (See section: "Tasks that require root user credentials").