1The God Mode Problem
The AWS Root account is created with the email address used to open the AWS account. Unlike IAM users, the Root user cannot have its permissions restricted by IAM policies. It can close the account, change support plans, and access billing. If it's compromised, your business is compromised.
2The Layered Defense
Security is about layers. A strong password is layer one. MFA is layer two. The principle of least privilege (using IAM instead of Root) is layer three. By combining these, you exponentially reduce your attack surface.
3Step-by-Step Breakdown
The Root Account. The AWS Root account has unrestricted, undeletable access to everything in your account, including billing.
Stop Using Root. The very first thing you should do with a new AWS account is create an Admin IAM user, and stop using Root.
What is MFA?. Multi-Factor Authentication requires something you know (password) AND something you have (a device).
Enabling MFA on Root. You must enable MFA on your root account immediately. It is the single most important security step.
Delete Root Access Keys. Never generate programmatic access keys for the Root account. If they exist, delete them.
Root Best Practice. What is the recommended best practice for the AWS Root user account?
- →Use it for daily admin tasks
- →Enable MFA, create an IAM Admin, and never use Root again
- →Share the password with your team
Enforcing MFA via Policy. You can write IAM policies that deny access to resources unless the user authenticated with MFA.
Hardware vs Virtual. Virtual MFA runs on a phone. Hardware MFA (like a YubiKey) is a physical device and is more secure against phishing.
Account Recovery. If you lose your MFA device, AWS Support requires identity verification (phone, email) to restore root access.
Completion. Your AWS account foundations are now secure.
