A newly created AWS account's root user currently has no MFA device configured and an active access key that a script uses to run a daily automated task. Which change best aligns with AWS root user security best practices?
- Keep using the root access key for the daily script, since only the root user can guarantee sufficient permissions, and add a second root access key for redundancy
- Enable MFA on the root user, delete the root user's access keys, and move the daily automated task to an IAM role or IAM user that has only the permissions it needs
- Disable MFA entirely on every user in the account including root, since MFA devices are a common cause of account lockouts
- Create several additional root users, one per team, so that no single team depends on the same root credentials
Why B? And why not the others?
Correct answer: B. Enable MFA on the root user, delete the root user's access keys, and move the daily automated task to an IAM role or IAM user that has only the permissions it needs
AWS best practice is to protect the root user with MFA, avoid keeping any root access keys, and perform routine and automated tasks using an IAM role or IAM user scoped with only the permissions that task requires, reserving root for the rare actions that genuinely require it. The option that keeps using root access keys for a daily script, and even adds a second one, is wrong because it directly contradicts least privilege and expands the damage a single leaked credential could do, rather than reducing it. The option that disables MFA everywhere is wrong because removing a key protection against credential compromise is not how lockout risk is managed; lockout risk is instead addressed through backup MFA devices and account-recovery procedures. The option proposing several additional root users is wrong because an AWS account has exactly one root user that cannot be duplicated; the correct way to give teams independent, scoped access is through separate IAM roles or users, not additional root accounts.
Source: AWS IAM documentation: Security best practices for the AWS account root user (https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-best-practices.html)