CLF-C02 Question 111
Select 3Which of the following tasks can only be performed by the AWS account root user?
- A
Changing the AWS account support plan
- B
Creating access keys for the root user
- C
Enabling multi-factor authentication (MFA) for an IAM user
- D
Closing the AWS account
- E
Deleting an IAM role
Show answer and explanation
Correct answers: A, B, D
Explanation
Certain tasks in AWS are restricted to the root user due to their sensitive nature, such as managing the account's support plan, creating root user access keys, and closing the AWS account. These actions are tied to the account's ownership and require the highest level of permission, which only the root user has.
- A. Correct.
The root user is the only user that can change the AWS account support plan as it involves billing-related actions tied to the account's ownership.
- B. Correct.
Only the root user can create or manage its own access keys for security reasons, as it has unrestricted access to all resources in the account.
- C. Incorrect.
Enabling MFA for an IAM user can be performed by any IAM user or role with the necessary permissions, not just the root user.
- D. Correct.
Closing an AWS account is a sensitive action that can only be performed by the root user, as it involves deactivating all services and resources in the account.
- E. Incorrect.
Deleting an IAM role can be performed by any IAM user or role with sufficient permissions, not just the root user.