Every AWS account starts with one identity that can do everything: the root user. IAM policies cannot restrict it, so if someone gets in, there is no safety net. Before building anything else, lock it down.
What the root user is (and is not)
- It is the email address you signed up with, and it has unrestricted access to the whole account, including billing and closing the account.
- It is not an IAM user, so you cannot limit it with a policy.
- You should almost never sign in with it. Daily work belongs to IAM identities (Day 1) and roles (Day 3).
The root account checklist
| Step | Why it matters |
|---|---|
| Turn on MFA for the root user | A stolen password alone is no longer enough |
| Use a long, unique password in a password manager | Root should not share a password with anything else |
| Delete root access keys (or never create them) | A leaked key would have full power with no MFA prompt |
| Use a shared mailbox or alias you control | You keep recovery access if one person leaves |
| Keep alternate contacts and billing alerts up to date | You hear about problems early |
Choosing an MFA type
- Passkey or security key (FIDO2): phishing-resistant, the strongest everyday option.
- Authenticator app (TOTP): free, quick to set up, and fine for most learners.
- Hardware TOTP token: a physical code generator, mostly for strict environments.
You can register more than one MFA device on the same user, so add a second one as a backup.
Hands-on: try it in your own account
- Sign in as the root user, open the account menu and choose Security credentials.
- Under Multi-factor authentication (MFA), choose Assign MFA device.
- Give it a clear name, pick Authenticator app or Passkey or security key, and follow the prompts.
- Under Access keys, confirm there are none. If there are, delete them.
- Sign out and sign in again to confirm the MFA prompt appears.
- Create an IAM admin identity for daily use and stop using root.
Common mistakes
- Using root for everyday tasks "just this once".
- Keeping root access keys in a script or a laptop folder.
- Registering MFA on a single phone with no backup device.
- Using a personal inbox that only one person can read.
What only root can do
A short list of tasks still needs root, such as changing the account name or email, closing the account and restoring IAM permissions if you lock yourself out. That is the only reason to sign in as root.
Key takeaways
- The root user is unrestricted, so protect it before anything else.
- Turn on MFA, remove access keys and keep a backup MFA device.
- Do real work with IAM users and roles, not root.
Tomorrow I'll look at what comes next once the front door is locked.
Originally published on my blog. Part of #120DaysOfAWS.
