How to explain protecting the AWS root user and everyday admin access in an interview

The interviewer asks what the first security step is after creating a new AWS account. Many candidates respond by mentioning enabling multi-factor authentication (MFA), but a complete answer involves two parts. First, securing the root user, then putting it out of immediate use.

The root user has full access to every resource in the account. AWS advises against using the root user for everyday tasks. Think of the root user like the master key to a building - you don't keep it on your keyring for daily use. Instead, you lock it away in a safe and only use a key cut for specific doors.

To secure the root user's credentials, create a strong, unique password and enable MFA. AWS recommends using a password manager to generate strong passwords. The password must be 8 to 128 characters long and include uppercase letters, lowercase letters, numbers and symbols. It cannot match the account name or email. MFA adds an extra layer of security.

AWS supports hardware security keys, six-digit time-based one-time passwords, and virtual authenticator apps on a phone. It's crucial to register more than one MFA device for added resilience. If you lose the only device, you'll need to contact customer service to remove MFA.

Don't create access keys for the root user. These keys provide full access to all services and resources, including billing information. Root access keys are rarely needed, so AWS recommends using a separate administrative identity for everyday work. Assume temporary credentials instead of using long-term root keys. Roles have no long-term credentials and provide temporary security credentials when assumed.

Only people with a strict business need should have access to the root user's credentials. Don't share the root password, MFA, access keys or signing certificate.