SAA-C03 practice question: IAM roles and policies (3 of 3)

Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A consultancy has just opened a standalone AWS account, not part of AWS Organizations, for a new client project. The root user's email address and password were set during sign-up. Three engineers will administer the account day to day, and a CI/CD pipeline will deploy to it. The client's security policy requires the account to follow AWS guidance for protecting the root user. Which TWO actions should the consultancy take? (Choose two.)

Choose two answers.

A. Register an MFA device for the root user, and keep the root credentials where only a small, named group of people can use them.
B. Attach an IAM policy to the root user that denies everything except billing actions, so that its power is limited if it is misused.
C. Make sure the root user has no access keys, and give the pipeline its own IAM role with only the permissions it needs to deploy.
D. Create access keys for the root user, store them in AWS Secrets Manager with rotation, and let the pipeline read them when it deploys.
E. Share the root password with the three engineers through a password manager so that each of them can sign in for daily administration.

Show the answer and explanation

Answers: A, C

A. Right: Correct. AWS recommends securing root sign-in with multi-factor authentication and tightly limiting who can reach the root credentials. That way a stolen password alone cannot be used to take over the account. Learn more: Root user best practices for your AWS account (opens in a new tab)
B. Wrong: You cannot attach identity-based policies or a permissions boundary to the root user. In an account that belongs to an organisation, an SCP can restrict it, but this account is standalone. Protect the root user with MFA and by not using it instead. Learn more: Policies and permissions in IAM (opens in a new tab)
C. Right: Correct. AWS advises against creating root access keys, because they carry unlimited power and do not expire. The pipeline should use a role with least-privilege permissions and temporary credentials. Learn more: Root user best practices for your AWS account (opens in a new tab)
D. Wrong: Storing and rotating the keys does not change what they are: long-term credentials with unlimited access to the account. AWS guidance is not to create root access keys at all. Give the pipeline a least-privilege IAM role instead. Learn more: AWS Secrets Manager (opens in a new tab)
E. Wrong: The root user should be kept for the few tasks that need it, not used for everyday work by several people. Each engineer should have their own identity with administrator permissions, such as through IAM Identity Center. Learn more: Root user best practices for your AWS account (opens in a new tab)

Explanation

AWS root user guidance includes turning on MFA, keeping the credentials tightly controlled, never creating root access keys, and using separate identities with temporary credentials for daily work and automation. Identity-based policies cannot be attached to the root user; only SCPs or RCPs can limit it, and only inside AWS Organizations.

Study

Root user best practices for your AWS account

SAA-C03 practice question: IAM roles and policies (3 of 3)

Explanation

Study

Keep practising