AWS IAM Administrator Best Practices: Root, MFA and Break-Glass
The root user is the master key to the whole AWS shop. You use it to open once, turn on MFA, create an admin path, then lock it away. Daily work uses IAM roles or Identity Center — never root.
What you'll learn in this chapter
- Why root is not for daily work
- MFA on root and humans
- Break-glass admin pattern
- Permission boundaries overview
- CloudTrail and recovery habits
1. Everyday example first
Why do we need this?
Your flat’s main door key is not lent to the delivery person every day. You give a temporary building gate code instead. Root is the main door key of the AWS account.
What is it?
The root user is the email+password that created the account. It bypasses almost every IAM deny. A leak means the attacker can close your account, change billing, or wipe resources.
2. Root checklist
- Turn on MFA for root (hardware key preferred for production). Store backup codes offline.
- Do not create access keys for root.
- Use root only for a short list: account settings, billing contacts, changing support plan, breaking a bad SCP, recovering MFA — then sign out.
- Create an admin path: Identity Center Admin permission set or a tightly controlled IAM admin role — not a shared “admin” password on WhatsApp.
3. Break-glass
Why do we need this?
If SSO breaks at 2 a.m., someone still needs a way in — without making every developer an Administrator.
What is it?
- Break-glass role/user: high power, MFA mandatory, used only in incidents, monitored by CloudTrail alarms.
- Store credentials in a sealed process (password manager / hardware key), not in the team chat.
- Practice assume/login once a quarter so the process works.
- After use: rotate secrets and write a short incident note.
4. Permission boundaries (overview)
A permissions boundary is a maximum ceiling on what an identity can ever be granted. Even if someone attaches AdministratorAccess, the boundary can cap them at (for example) only their project prefix. Useful when you let builders create roles.
You do not need to master every boundary JSON tonight — know the word and that it is a safety rail for delegated admin.
5. Daily admin habits
- MFA on every human.
- CloudTrail (and preferably Organization trail) on.
- Least privilege permission sets; separate billing from engineering where possible.
- No long-lived keys on laptops for daily work — SSO or roles.
- Review unused users/keys monthly.
Ravindra Bagale's Tip
Beginners paste root password into shared Google Docs “for the team”. That is how accounts get mined for crypto. Use Identity Center invites instead.
6. Interview angles
Q. Why not root daily?
Unlimited power; breach = full account.
Q. Break-glass?
Rare emergency admin path with MFA and audit.
Q. Permission boundary?
Ceiling on max permissions an identity can receive.
Q. Root access keys?
Never create them.
Q. First hour on a new account?
Root MFA, no root keys, set up Identity Center or admin role, enable CloudTrail.
Try at home
- Confirm root MFA is on in your lab account; remove any root access keys if they exist.
- Next: read IAM policy JSON deeply (Effect, Action, Resource, Condition).
In short
- Root is rare; MFA; no root keys.
- Break-glass is planned emergency access.
- Permission boundaries cap delegated power.
- CloudTrail + least privilege every day.
Practice Tasks
Seoul Beauty Lab is a cosmetics business in Seoul. Ji-woo Park looks after its IT and cloud work. They count money in KRW and run their AWS resources in the ap-northeast-2 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 12
Easy Create an IAM user
Why: Every person should have their own user, never the root user.
What to do: Create an IAM user named jiwoo.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy Add a user to a group
Why: The user gets all the group's permissions at once.
What to do: Add jiwoo to the Developers group.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Create a key pair
Why: You need a key pair to SSH into new Linux instances.
What to do: Create a key pair named seoulbeauty-key.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium List a user's MFA devices
Why: Auditors check that every user with console access has MFA.
What to do: List the MFA devices of user jiwoo.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Attach a managed policy to a group
Why: AWS managed policies are ready-made and kept up to date by AWS.
What to do: Attach the AWS managed policy arn:aws:iam::aws:policy/ReadOnlyAccess to the group Auditors.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Require MFA to delete
Why: Risky actions should need MFA, so a stolen password is not enough.
What to do: Deny s3:DeleteObject on arn:aws:s3:::seoulbeauty-data/* when MFA is not present (aws:MultiFactorAuthPresent is false).
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Test a policy before using it
Why: The policy simulator tells you if an action would be allowed, without doing it.
What to do: Check whether user arn:aws:iam::119519391020:user/jiwoo may call s3:GetObject.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Deny access from outside the office
Why: An explicit Deny with aws:SourceIp blocks keys used from anywhere else.
What to do: Write one Deny statement: deny all actions (*) on all resources (*) when the source IP is NOT in 203.0.113.0/24.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Block other Regions (SCP style)
Why: Data rules (like keeping data in one country) are enforced with aws:RequestedRegion.
What to do: Deny ec2:* on * when aws:RequestedRegion is not ap-northeast-2.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Allow only on tagged servers
Why: Tag conditions let one team control only its own servers.
What to do: Allow ec2:StopInstances on any instance (*) only when the instance tag Team equals seoulbeauty.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Deny requests without HTTPS
Why: aws:SecureTransport false means plain HTTP; deny it to protect data in transit.
What to do: Bucket policy: deny s3:* for everyone (*) on seoulbeauty-data and its objects when aws:SecureTransport is false.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Put the role in the instance profile
Why: The profile is empty until you add the role to it.
What to do: Add role seoulbeauty-ec2-role to instance profile seoulbeauty-ec2-profile.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Revision, comparison and interview cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.