Root User
The all-powerful account identity created when an AWS account is opened.
The root user is the original identity created when an AWS account is first opened, authenticated by the account’s email address and password rather than IAM credentials. It has unrestricted access to every service and billing setting and cannot have its own permissions reduced by any policy. Because of this, AWS recommends protecting it with a hardware or virtual MFA device immediately and then leaving it dormant for routine work.
The key exam distinction is that a handful of tasks are root-only and cannot be delegated to any IAM user or role — closing the account, changing the AWS support plan, and restoring IAM permissions are classic examples. Everyday administration should use IAM users or roles with least-privilege policies instead.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →