Question

A financial services company manages 60 accounts under AWS Organizations with all features enabled. The security team discovered that some workload teams have been performing sensitive actions (such as modifying account-level settings) directly as the account root user. Compliance requires that the root user in every member account be prevented from taking any actions except those absolutely necessary, while normal IAM roles and users continue to operate unaffected. The security team wants a centrally managed, preventive control that applies to all current and future accounts. Which approach BEST meets these requirements?

Accepted Answer

Attach an SCP to the organization root that denies actions when the principal is the root user (using the aws:PrincipalArn condition matching the account root), and attach it to all OUs including a mechanism that covers new accounts.

Answer

Configure an IAM permissions boundary on the root user of each member account limiting the actions the root user can perform.

Answer

Enable AWS Config with a managed rule that detects root user activity and automatically remediates by disabling the root user credentials.

Answer

Set a strong password policy and require MFA on the root user of each account through IAM Identity Center permission sets.