CLF-C02 Question 109
Select 3Which of the following tasks can only be performed by the AWS account root user?
- A
Changing the root user's password
- B
Deleting an AWS account
- C
Creating an IAM user
- D
Enabling Multi-Factor Authentication (MFA) for an IAM user
- E
Restoring permissions for the root user
- F
Enabling AWS Organizations for the account
Show answer and explanation
Correct answers: A, B, E
Explanation
The AWS account root user has unique privileges and responsibilities that cannot be delegated to IAM users, regardless of their permissions. Tasks such as changing the root user's password, deleting an AWS account, and restoring root user permissions are highly sensitive and restricted to the root user to ensure security and control over the account.
- A. Correct.
Correct. Only the root user has the ability to change its own password. This is a highly sensitive operation restricted to the root user.
- B. Correct.
Correct. The root user is required to delete an AWS account as it involves critical changes to account ownership and billing.
- C. Incorrect.
Incorrect. IAM users can be created by other IAM users with the appropriate permissions, not just the root user.
- D. Incorrect.
Incorrect. Enabling MFA for an IAM user can be done by users with the appropriate permissions in AWS, not exclusively by the root user.
- E. Correct.
Correct. Restoring permissions for the root user, such as regaining access in case of accidental permission removal, can only be done by the root user.
- F. Incorrect.
Incorrect. Enabling AWS Organizations can be performed by an IAM user or role with the necessary permissions, not just the root user.