Root user

The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.

Think of it as: The master key to the whole building.

What to know for Level 0

Root can do almost anything in its account. IAM policies can't restrict it; only an SCP can, and only in a member account.
Turn on MFA, never create root access keys, never share the password, and use root only for the few jobs that need it, like closing the account or changing its email. Day to day, people sign in through IAM Identity Center.
You sign in as root with the account's email address. It has no username and can't be renamed.

More detail

IAM policies can’t limit root (only SCPs can, and only in member accounts). Protect it with MFA, never create access keys for it, and use it only for the few jobs that require it, such as closing the account or changing its email address.

Quiz yourself on Root user →

← All terms