AWS Root User Privileges – Overview and Best Practices

The AWS Root User is the most powerful identity in your AWS account. It has full administrative access to all AWS services and resources within that account. Understanding its privileges and managing it securely is paramount for your overall AWS security posture.​

What is the Root User?

• Initial Identity: It's the email address and password you used to create your AWS account.
• Unrestricted Access: The Root User has permissions to perform any action on any resource in the account, including actions that IAM users cannot perform.
• Global Scope: Its permissions are not restricted by IAM policies. 

Unique Root User Privileges

The Root User can perform actions that IAM users (even those with AdministratorAccess policy) cannot. These include:

• Account Settings:
  • Changing your AWS account settings (e.g., account name, contact information).
  • Closing your AWS account.
  • Changing your AWS Support plan.
  • Restoring IAM user permissions.
• Billing & Payments:
  • Changing the primary payment method.
  • Viewing certain tax invoices.
  • Registering as a seller in the Reserved Instance Marketplace.
• Security & Credentials:
  • Activating MFA on the Root User.
  • Changing the Root User password.
  • Requesting a limit increase for certain services (e.g., EC2 instances).
• Other:
  • Accessing AWS Artifact.
  • Migrating an EC2 instance out of EC2-Classic.

Best Practices for Root User Security

Given its immense power, the Root User should be used extremely sparingly and secured with the highest possible measures.

• A. Lock Away Root User Credentials:
  • Do NOT use the Root User for daily tasks. Create an IAM user with administrator permissions for everyday administrative work.
  • Strong, Unique Password: Use a very long, complex, and unique password.
  • Enable Multi-Factor Authentication (MFA):
    • Always enable MFA on the Root User.
    • Use a physical MFA device (hardware token) or a virtual MFA device (e.g., Google Authenticator, Authy) on a dedicated, secure device.
    • Consider storing the MFA device and password in a physical safe or secure location.
• B. Restrict Root User Usage:
  • Only use the Root User for tasks that require it. Refer to the AWS documentation for a definitive list of these tasks.
  • Avoid sharing Root User credentials.
• C. Monitor Root User Activity:
  • Enable AWS CloudTrail in all regions to log all API calls, including Root User activity.
  • Set up CloudWatch Alarms to notify you of any Root User activity.
• D. Review and Audit:
  • Periodically review your Root User credentials and MFA setup.
  • Audit CloudTrail logs for any unauthorized Root User activity.