Which task requires the use of aws account root account user credentials?

AWS re:Invent is the annual AWS conference held in Las Vegas, which this year celebrates its 10th anniversary. re:Invent is back as an in person event for 2021, after the 2020 event ran online only due to Covid 19. I was unable to attend the event in person this year, but I live streamed the […]

Why Should you Care About Amazon Keyspaces (Managed Apache Cassandra Service)?

**Updated 24th April 2020 when Amazon Managed Apache Cassandra Service went GA as Amazon Keyspaces** Last week at re:Invent 2019, AWS CEO Andy Jassy announced the launch of the preview for the new Amazon Managed Apache Cassandra service (launched in GA as Amazon Keyspaces).  But what exactly is it, and why should you care?   Apache Cassandra […]

The AWS Account Root User is the first identity created with the AWS Account and has the highest level of privileges. The Root User account has unrestricted access to all AWS services and resources and is used for account and service management tasks, to create a new account for administrative, and other tasks.

We recommend you minimize the use of the Root User account by adopting the Principle of Least Privilege for access management. This reduces the risk of accidental changes and unintended disclosure of highly privileged credentials.

Fix - Runtime

Procedure

Replace usage of the AWS root with IAM users with minimal set of permissions necessary to access and manage just the required AWS resources and services. For example, you can add an MFA enabled user that can perform a limited set of privileged activities. Consider also using the IAM Administrator Managed Policy.

Fix - Buildtime

Consider using AirIAM, an open source project that enables creating least privilege IAM manifests that replace existing over-permissive IAM settings.

As we all know it is AWS best practice to not use the root user. However, there are certain Tasks which requires root credentials. But why? The root user gives full access to all your resources for all AWS services, including your billing information. Moreover there is no way to reduce the permissions associated with your AWS account root user access key. Additionally it is required from compliance perspective to enable multi-factor with a Hardware MFA device for root.

So please remember:
🚨 If you do have an access key for your AWS root user, delete the access key.
🚨 Enable MFA for root user with a Hardware MFA device and lock it in a safe.
🚨 Create an IAM user for yourself that has administrative permissions and use the root user just for the following tasks.

1. Change your account settings (account name, root user password, email address and enable MFA)

How to change your Account Name, Root User Password, and Root User Email Address

1. Sign in to your AWS Account with root credentials.
2. Open the Billing and Cost Management console.
3. On the navigation bar, choose your Account and then then choose My Account.
4. On the Account Settings page, choose Edit.
5. Next to the field to update, choose Edit.
6. Enter your changes and choose Save changes.
7. Choose Done.

How to enable MFA for root user

1. Sign in to your AWS Account with root credentials.
2. Open the Billing and Cost Management console.
3. On the navigation bar, choose your Account and then then choose My Security Credentials.
4. Expand Multi-factor authentication (MFA)
5. Click Activate MFA
6. Follow the instructions in the Activate MFA box.

2. Change your AWS support plan

How to change your AWS support plan

1. Sign in to your AWS Account with root credentials.
2. Open the Billing and Cost Management console.
3. On the navigation bar, choose your Account and then then choose My Account.
4. Scroll to the Manage AWS Support Plans section.
5. Click on the Click here to manage AWS Support plans button.
6. Choose your new AWS Support Plan and click Change Plan.

3. Closing an AWS Account.

How to close your AWS Account

1. Sign in to your AWS Account with root credentials.
2. Open the Billing and Cost Management console.
3. On the navigation bar, choose your Account and then then choose My Account.
4. Scroll to the end of the page to the Close Account section.
5. Select the check box to accept the terms and then choose Close Account.
6. In the confirmation box, choose Close Account.

4. Submit a Reverse DNS for Amazon EC2 request.

How to submit a Reverse DNS for Amazon EC2 request.

5. Request removal of the port 25 email throttle on your EC2 instance.

How to request removal of the port 25 email throttle on your EC2 instance

6. Configure an Amazon S3 bucket to enable MFA (multi-factor authentication) Delete.

How to enable MFA delete for an S3 bucket

Unfortunately it is currently not supported to enable MFA delete via Console. You need to use the following command to enable MFA delete for a bucket:

Which of the following is an AWS best practice for using the AWS account root user credentials?

Which term applies to a person or application that uses the AWS account root user?

Which of the following should be done by the account root user?

Which of these actions can only be performed by the root account user?