A new cloud admin proposes sharing the AWS account root user daily among the public-works team for routine changes. What is the correct foundational response?
Select an answer to reveal the explanation.
Short Explanation
Root is the master key to city hall — you do not loan it out for every lightbulb change. Protect it, lock it down, and let staff use IAM users or roles for daily work. Sharing root for routine ops is a classic foundational mistake.
Full Explanation
Reject sharing the AWS account root user daily among the public-works team for routine changes. Protect the root user, reserve it for rare account-level tasks, and use IAM users or roles for daily administration. Root is the master key to city hall — you do not loan it out for every lightbulb change. Approving shared root logins because root is supposedly the recommended daily operator identity is foundationally wrong. Requiring everyone to email the root password after each shift worsens exposure. Enabling root for all contractors permanently so MFA is never needed inverts hardening guidance. Distractors fail by normalizing shared root, by spreading passwords for faux accountability, or by disabling MFA incentives. Exam caveat: certain account-level actions remain root territory, which is exactly why root must stay rare, MFA-protected, and monitored — not why it should become the helpdesk login. Operational check: confirm root has MFA, no routine root access keys, break-glass procedures documented, daily public-works changes performed via IAM roles or users with CloudTrail visibility, and periodic checks that root last-used timestamps stay near-idle. In practice, measure success by near-zero root console usage for public-works changes and by every routine ticket showing an IAM principal in CloudTrail instead of root.