Protecting the root user: CLF-C02 study notes and practice questions
What to know about Protecting the root user for the CLF-C02 exam, from the Security and Compliance domain (30% of the exam guide), then 2 free questions to test it. Part of the CLF-C02 study guide.
Every AWS account has one root user, created with the email address used to open the account. It has full access to everything, so the exam focuses on protecting it and knowing when you actually need it.
Best practices
Turn on MFA for the root user. Supported types are FIDO security keys (passkeys), virtual authenticator apps and hardware TOTP tokens, and you can register more than one device.
Don’t create access keys for the root user; delete any that exist.
Use a strong, unique password and a secure email address for the account.
Don’t use it for everyday tasks. Create administrative users in IAM Identity Center or IAM.
Monitor its use: root sign-ins appear in CloudTrail, and an EventBridge rule or CloudWatch alarm can alert you.
In AWS Organizations, member accounts can have their root credentials removed and managed centrally from the management account.
Tasks that need the root user
Changing the account’s root email address, root password or account name (and some contact settings)
Closing the AWS account (for a standalone account)
Activating IAM user and role access to the Billing and Cost Management console
Fixing an S3 bucket policy (or SQS queue policy) that denies everyone, including administrators
Restoring IAM user permissions if the only administrator locks themselves out
Registering as a seller in the Reserved Instance Marketplace
Configuring an S3 bucket to require MFA delete
Common traps
Thinking an IAM policy can limit the root user. It can’t in a standalone account; only an SCP in AWS Organizations can limit the root user of a member account.
Creating an IAM user and then “deleting” the root user. The root user can’t be deleted; protect it instead.
Using root access keys for automation. Use IAM roles.
B. Wrong: A monthly check would find root sign-ins weeks after they happen. Event history is useful for review, but it does not alert the team when a sign-in occurs.
C. Wrong: Amazon Inspector scans EC2 instances, container images and Lambda functions for software vulnerabilities. It does not monitor sign-in events.
D. Wrong: AWS Artifact provides AWS's compliance reports and agreements. It does not record sign-in activity for a customer's account.
Explanation
Root user activity is recorded in AWS CloudTrail. AWS recommends alerting on root user sign-in and use, for example with an EventBridge rule that notifies the team through an SNS topic. The other options either check far too late, or describe services that do not monitor sign-ins.
A company is shutting down a standalone AWS account that is not part of AWS Organizations.
Its administrators use their IAM identities for everything else.
Which task can be done only by signing in as the root user?
Choose one answer.
AA. Changing the account name in the account settings
BB. Closing this standalone AWS account, which ends its services
CC. Creating an IAM user with administrator permissions
DD. Updating the alternate billing and security contacts
Show the answer and explanation
Answer: B
A. Wrong: AWS does not require root user credentials to change the account name. Other account settings, such as the name and contacts, can be changed without them.
C. Wrong: An IAM identity with the right permissions can create IAM users. Root user credentials are not needed for this.
D. Wrong: AWS lists alternate contacts among the settings that do not require root user credentials. They can be updated without root.
Explanation
For a standalone account outside AWS Organizations, closing the account requires root user credentials. Renaming the account, updating alternate contacts and creating IAM users do not need the root user, so the root user should be used only for the few tasks that require it.
Want more on Protecting the root user? The 5 full-length practice sets have 10 more Protecting the root user questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →