A fintech company runs 45 AWS accounts in Organizations where each member root user still has a long-term password. Auditors require removal of standalone root credentials, MFA-protected privileged access, and a documented emergency path with full audit trails. Which root-management approach should the security architect implement to centralize member root control and break-glass recovery?
Select an answer to reveal the explanation.
Short Explanation
You're cutting off dozens of skeleton keys and keeping one guarded master key instead. With centralization enabled, no standing root passwords remain and privileged tasks happen in short, logged sessions.
Full Explanation
The correct approach is right because centralized root management in Organizations lets the management account perform governed short-term privileged tasks without standing passwords, deleting member root credentials removes reuse and takeover risk across all 45 accounts, enforcing MFA on those elevated sessions meets the auditor authentication control, and combining management-account actions with CloudTrail and a formal audited break-glass runbook delivers both emergency recoverability and full auditability. The per-account deletion approach fails on centralization because handling passwords and role assumption separately in every member preserves operational sprawl and prevents unified control, visibility, and privileged-session governance from the management account even while it correctly uses MFA, logging, and a runbook. The centralized SSO approach fails on authentication assurance because federated SSO with logging gives convenience and traceability but without an explicit MFA step it does not satisfy the stated MFA-protected privileged-access requirement for root-level actions. The vault-retention approach fails on credential elimination because keeping recoverable long-term root passwords, even secured in a vault, preserves the exact standalone-credential risk the auditors required to remove and conflicts with short-term least-privilege access. An exam caveat is that logging alone does not equal governance and SSO alone does not equal MFA, so look for all three controls together: no standing root credential, MFA-enforced elevation, plus documented approvals with audit trails. As a practical check, confirm no member root has a standing password, run a supervised privileged session from the management account to verify MFA enforcement, then tabletop-test break-glass recovery and trace each step to CloudTrail events and runbook approvals.