CLF-C02 Practice Question 84: Root User Tasks

AWS publishes a short list of tasks that require root user credentials. For a standalone account that is not part of AWS Organizations, the list includes closing the AWS account and updating root-level account settings: the root user's email address, password and access keys. Other tasks on the list include restoring IAM permissions if the only administrator locks themselves out, activating IAM access to the Billing and Cost Management console, and configuring MFA delete on an S3 bucket.

Option B is ordinary IAM administration, which any identity with the right IAM permissions can do. That is exactly why AWS recommends creating administrative identities so the root user isn't needed day to day. Options D and E are account settings that AWS explicitly lists as not requiring root credentials, along with the account name, contact information and payment currency preference. In an organization, several root-only tasks for member accounts, including closing them, can instead be done centrally by the management account.

Reference: AWS account root user