Question

A security team manages an AWS Organization with all features enabled and 60 member accounts across several organizational units (OUs). A recent audit found that some account teams occasionally log in with the account root user to perform routine tasks. The team wants to enforce, organization-wide, that the root user of any member account cannot perform any actions except a small set of tasks that only root can do (such as changing account settings that require root), while still allowing IAM principals to operate normally. Which approach best meets this requirement at scale?

Accepted Answer

Attach an SCP to the organization root that uses a Deny statement with a condition on aws:PrincipalArn matching the root user ARN, excluding the specific root-only actions the team needs.

Answer

Create an IAM permissions boundary and attach it to the root user in each member account to restrict its effective permissions.

Answer

Enable a Config managed rule that detects root user activity and automatically deletes the root user credentials in each account.

Answer

Apply an IAM identity-based policy with an explicit deny for the root user across all member accounts using a StackSet.