An AWS Organizations review shows municipal member accounts still use the root user for daily tasks and several roots lack MFA. Which identity-hygiene improvement should be implemented org-wide?
Select an answer to reveal the explanation.
Short Explanation
Root is the nuclear key—great in a sealed box with MFA, awful as the daily coffee-run badge. Push people to Identity Center or roles and lock root behind MFA for emergencies only. That hygiene upgrade pays rent every day.
Full Explanation
Municipal member accounts that still use the root user for daily tasks, with several roots lacking MFA, fail basic identity hygiene in AWS Organizations. Prohibiting routine root use, enforcing MFA on root, and operating through IAM Identity Center or IAM roles—with break-glass root procedures only—aligns day-to-day work to least privilege. That org-wide improvement works because root is an emergency identity, not a deployment convenience; MFA and federation shrink account-takeover risk. Encouraging root usage for deployments because it bypasses permission boundaries fails by design against least privilege. Sharing root passwords through a printed binder in break rooms fails conceptually on secrecy and auditability. Creating IAM users with AdministratorAccess in lieu of MFA on root while continuing routine root logins fails by stacking excess privilege without fixing root hygiene. Exam caveat: break-glass root access still needs sealed credentials, MFA devices, and logged retrieval—banning routine root without an emergency procedure strands recovery. Operational check: inventory root MFA status across member accounts, enforce MFA, migrate daily tasks to Identity Center permission sets, document break-glass, and alert on root console logins via CloudTrail.