Question

A company manages 40 AWS accounts under AWS Organizations with all features enabled. The security team discovers that some account root users have been used to make configuration changes, violating the company's policy that all administrative work must be performed through federated IAM roles. The team wants a preventive, organization-wide guardrail that blocks any action performed by the root user across all member accounts, without affecting IAM roles or users. Which approach meets this requirement?

Accepted Answer

Attach a service control policy (SCP) to the organization root that denies all actions when the aws:PrincipalArn condition matches the account root user ARN.

Answer

Enable AWS Config with a managed rule that flags root user activity and configure an automatic remediation to delete the root user credentials.

Answer

Create an IAM permission boundary that restricts the root user to read-only actions and apply it to each member account.

Answer

Configure a CloudTrail metric filter and CloudWatch alarm to notify the security team whenever the root user signs in.