Closing the AWS account or changing certain account settings is treated as root-level territory. What should the city do for ordinary daily cloud work?

Reserve the root user for rare account-level tasks such as closing the account or changing certain account settings, and perform ordinary daily cloud work with IAM users or roles. Root is the emergency wrench in the glass case — break it out for account-level work, then lock it away again. Using root for all console clicks so logs stay simple is not a valid simplification and concentrates risk. Sharing root MFA devices across departments without logging weakens control and attribution. Creating root access keys for every automation pipeline recreates the skeleton-key problem. Distractors fail by normalizing daily root, by sharing MFA factors, or by piping root keys into automation. Exam caveat: some settings remain root-only, which argues for stronger root protection, not broader root use. Operational check: publish a root-use policy listing allowed tasks, enforce MFA, ban root access keys, require dual control for break-glass, run everyday builds and stops under IAM, and alert on any root console login in municipal accounts. In practice, label root as account surgery only, run daily municipal changes under IAM, and include root-login alerts in the security operations playbook. Document the decision in the municipal cloud runbook so the next on-call engineer inherits the same standard.