Exam-style
A company has locked down its AWS account root user with MFA and removed its access keys, and all daily work happens through an IAM identity carrying the AdministratorAccess managed policy. Which of the following tasks still requires signing in as the root user?
Reveal the answer
D. Turning on MFA delete for a versioning-enabled S3 bucket
MFA delete can only be turned on by the bucket owner’s root user, and no IAM policy grants it. It is set through the CLI or API rather than the console, on the same call that configures bucket versioning. The Support plan is the trap: much study material still lists it as root-only, but AWS governs it through IAM, with AWSSupportPlansFullAccess and AWSSupportPlansReadOnlyAccess as the managed policies, so an administrator can change it. Developer Support, Business Support and Enterprise On-Ramp end on 1 January 2027, leaving Basic, Business Support+, Enterprise and Unified Operations. Creating roles, configuring CloudTrail and attaching service control policies are likewise ordinary IAM-governed actions that AdministratorAccess covers; the last two run from the Organizations management account or a delegated administrator rather than from root. What remains root-only is short. For a standalone account: the root email address, root password and root access keys, and closing the account. Then restoring IAM permissions after the only administrator has revoked their own; activating IAM access to the Billing and Cost Management console, plus a few other billing and tax items; registering as a seller in the Reserved Instance Marketplace; signing up for GovCloud; linking an account to a Mechanical Turk Requester account; MFA delete; and repairing an S3 bucket policy or SQS queue policy that denies every principal. Inside AWS Organizations several of those move to the management account, which is how an organisation avoids depending on member-account root credentials at all.
Q. Which of these can an AdministratorAccess identity not do?
A. Turn on MFA delete for an S3 bucket. That one is root only, and no IAM policy grants it. It goes on with the CLI or API, never the console.
Why? Most of the reserved tasks change or recover the account itself, so they cannot depend on a permission an administrator could remove. Changing the Support plan is not among them, whatever the study notes say. AWS governs that one through IAM, with managed policies of its own.