The lead member of a DevOps team creates an AWS account. A DevOps engineer shares the account credentials with a solutions architect through a…

The most critical first steps to secure an AWS account's root user, especially after its credentials have been shared, are to reset the password and enable Multi-Factor Authentication (MFA). Changing the password to a new, strong, and unique value immediately invalidates the shared credentials (A). Enabling a virtual MFA device adds a crucial second layer of security, requiring a time-based one-time password (TOTP) in addition to the password for login, which protects the account even if the password were to be compromised again (B). These two actions directly address the security of the root user identity itself, which is the core requirement of the question.

C. Creating IAM users is a vital security practice for daily operations but does not secure the root user itself. The root user would remain vulnerable without a strong password and MFA.

D. Creating access keys for the root user is strongly discouraged by AWS security best practices. Programmatic access should be handled through IAM roles, not root keys.

E. The root user's permissions cannot be restricted by an IAM role or policy. The root user has ultimate authority over the account and all its resources by definition.

1. AWS Identity and Access Management (IAM) User Guide: In the "Security best practices in IAM" section

AWS explicitly recommends: "Use a strong and unique password for your AWS account root user" and "Enable MFA on your AWS account root user." This directly supports options A and B.

Source: AWS IAM User Guide

"Security best practices in IAM

" Document revision date: 2024-04-25.

2. AWS Identity and Access Management (IAM) User Guide: The same guide advises against creating root access keys: "we recommend that you do not create access keys for your root user." This directly refutes option D.

Source: AWS IAM User Guide

"Security best practices in IAM

" section "Lock away your AWS account root user access keys

" Document revision date: 2024-04-25.

3. AWS Identity and Access Management (IAM) User Guide: The guide clarifies the inability to restrict the root user: "You cannot use AWS IAM policies to explicitly deny the root user access to resources. The root user has full access to all resources in the account." This makes option E technically incorrect.

Source: AWS IAM User Guide

"IAM JSON policy elements: Principal

" section "Details for AWS account principals

" Document revision date: 2024-04-25.