Which actions should the Security Analyst take to meet these requirements?
(Choose three.)
Delete the access keys for the account root user in every account.
Create an admin IAM user with administrative privileges and delete the account root user in every account.
Implement a strong password to help protect account-level access to the AWS Management Console by the account root user.
Enable multi-factor authentication (MFA) on every account root user in all accounts.
Create a custom IAM policy to limit permissions to required actions for the account root user and attach the policy to the account root user.
Attach an IAM role to the account root user to make use of the automated credential rotation in AWS STS.
Explanations:
Deleting the access keys for the account root user is a best practice as it prevents any potential misuse of these keys, thereby enhancing security. The root user should not have access keys unless absolutely necessary, and using IAM users with appropriate permissions is recommended instead.
The account root user cannot be deleted; it is the original user created when the AWS account was established. While it is advisable to minimize the use of the root account, deleting it is not possible. Instead, best practices involve creating IAM users with the necessary permissions.
Implementing a strong password for the root user helps in protecting account-level access. This is crucial as the root user has unrestricted access to all resources within the account, making a strong password essential for security.
Enabling multi-factor authentication (MFA) on the account root user significantly enhances security. MFA adds an additional layer of protection by requiring a second form of verification beyond just the password, reducing the risk of unauthorized access.
It is not possible to attach a custom IAM policy to the account root user. The root user inherently has full permissions and cannot have restrictions placed on it through IAM policies. Best practices recommend limiting the use of the root account and using IAM users for specific roles.
Attaching an IAM role to the root user is not a valid action, as IAM roles are designed to be assumed by IAM users or services, not the root user itself. The root user has a unique status and cannot utilize roles or automated credential rotation in the same way that IAM users can.
From what I’ve seen, the answer is:
Delete the access keys for the account root user in every account.