DEV Community

Cover image for ACCOUNT & ROOT MANAGEMENT
Ntseze-Nelvis
Ntseze-Nelvis

Posted on

ACCOUNT & ROOT MANAGEMENT

#aws #tutorial #security #devops

AWS IAM ACCOUNT & ROOT MANAGEMENT Deep Dive

📌 This article is part of the AWS IAM Deep Dive series.

- Part 6: AWS IAM ACCOUNT & ROOT MANAGEMENT Deep Dive

1. What Is Account & Root Management in AWS IAM?

AWS Account & Root Management focuses on securing the foundation of your AWS environment. Your root user, account settings, and password policies.

Since the root user has full, unrestricted access, it’s the most powerful (and dangerous) identity in your AWS account.

Proper management ensures you protect this identity while enforcing strong authentication and governance across all users.

2. The Root Account — Handle With Extreme Care

The root user is automatically created when you first set up your AWS account.

It can perform any action, including deleting your entire account — which is why it should rarely (if ever) be used.

⚠️ Dangers of Using the Root Account

  • Bypasses IAM permissions and SCP restrictions
  • Can delete CloudTrail logs or disable billing alerts
  • Often targeted in phishing and credential theft attacks

3. Securing the Root Account

Step 1: Enable MFA (Multi-Factor Authentication)

Go to IAM → Dashboard → Activate MFA on Root Account

Choose Virtual MFA (e.g., Google Authenticator) or Hardware MFA token.

MFA description

Benefit: Prevents unauthorized sign-in even if your password is leaked.

Step 2: Create an Admin IAM User

  • Create a new IAM user (e.g., admin-user)
  • Assign it AdministratorAccess permissions
  • Use this account for all administrative actions — not the root user

root account

Tip: Store root credentials securely and use them only for critical tasks like billing or MFA recovery.

Step 3: Add Recovery Contacts

Add alternate contacts under Account Settings → Alternate Contacts

Include security, billing, and operations emails.

Ensures AWS sends alerts to the right teams if incidents occur.

🔑 Step 4: Rotate and Secure Credentials

  • Use a password manager to store root credentials
  • Rotate them at least once a year
  • Never embed root credentials in scripts or CI/CD tools

4. Enforcing Account-Wide Security

Password Policies

Set strong password policies for IAM users:

  • Minimum 12 characters
  • Require uppercase, lowercase, number, and symbol
  • Prevent password reuse
  • Force rotation every 90 days

CLI Example: 

aws iam update-account-password-policy \
  --minimum-password-length 12 \
  --require-symbols \
  --require-numbers \
  --require-uppercase-characters \
  --require-lowercase-characters \
  --allow-users-to-change-password \
  --max-password-age 90 \
  --password-reuse-prevention 3
Enter fullscreen mode Exit fullscreen mode

Account Settings Overview

From IAM → Account Settings, you can:

  • Enable password policies
  • Configure sign-in URLs
  • Enforce MFA on all users
  • Set up an AWS Account Alias (e.g., company-login.awsapps.com)

Tip: Custom aliases make it easier and safer for employees to sign in.

5. Best Practices

  • Use the root account only for account setup and billing tasks
  • Enable MFA immediately after creating your AWS account
  • Delegate admin access to an IAM user or role
  • Regularly review account security from the IAM Dashboard
  • Audit root account usage via CloudTrail events

6. Hands-On Guide

🎯 Goal: Lock Down the Root Account

Step 1: Enable MFA on Root

Go to IAM Dashboard → Security Recommendations → MFA on Root Account → Activate

MFA

MFA-NAME

SAN MFA

Scan the QR code and store backup codes securely.

Step 2: Create a Secure IAM Admin User 

aws iam create-user --user-name admin-user
aws iam attach-user-policy \
  --user-name admin-user \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
Enter fullscreen mode Exit fullscreen mode
  • Test logging in as admin-user.

Step 3: Disable Root API Keys

Go to My Security Credentials → Access Keys and delete any active keys.

security-credentials

✅ Root should never have long-term access keys.

7. Industry Examples

🏢 Enterprise: Root account locked and controlled by InfoSec team; access only via MFA hardware token in a secure vault.

💻 Startup: Single owner uses root account only for billing, with daily operations done by IAM admins.

💰 Finance: Strict password policy enforced with quarterly credential audits.

🚀 DevOps: Admin roles delegated via AWS SSO, root used only for account recovery.

8. Interview Questions

🟢 Basic

  • What is the AWS root user?
  • Why should you avoid using the root account daily?

🟡 Intermediate

  • How do you enable MFA on the root account?
  • What does the account password policy control?

🔴 Advanced

  • How can CloudTrail be used to monitor root account activity?
  • How do you secure multiple AWS accounts under one organization?

🙏 Wrapping Up

The root account is the heart of your AWS environment — protect it like a crown jewel.

By enforcing MFA, password policies, and restricted usage, you build a strong foundation for all IAM security that follows.

🔑 Key Takeaways

  • Never use root for daily operations
  • Enable MFA and disable root access keys
  • Create an IAM admin for management
  • Enforce strong password and recovery policies
  • Thanks for reading!

If this helped:

❤️ Leave a like and follow for more AWS/DevOps deep dives

💬 Comment your IAM security tips

🔗 Share with your team to promote better AWS hygiene

🚀 Stay tuned for the next part of the IAM Deep Dive Series!

Top comments (0)