TopolearnMost serious AWS breaches start with a leaked root or admin credential or a misread of who is responsible for what.
An AWS account is a container for resources and the boundary for billing, quotas and security: by default nothing in one account can touch another. Mature setups use many accounts (per environment or team), which you will meet later with Organizations.
When you create an account you get the root user: the sign-up email and password. Root has unrestricted access, and IAM policies cannot limit it. Treat it as a break-glass credential:
- Enable MFA on it (AWS now enforces this), preferably a passkey or hardware key.
- Never create root access keys; delete any that exist.
- Use it only for the few tasks that require it, such as closing the account or changing some billing and support settings.
- Do daily work through IAM Identity Center or IAM roles instead.
The shared responsibility model splits security duties. AWS secures the cloud itself: facilities, hardware, the hypervisor and managed-service software. You secure what you put in it: identities and permissions, network rules, encryption choices, your data, and the operating system and patches on EC2 instances. The line moves with the service. On EC2 you patch the OS; on RDS AWS patches the database engine but you still choose who can connect; on Lambda AWS manages the runtime and you own the code and its permissions.
Misconfiguration (a public bucket, an over-broad policy, an open security group) is always on your side of the line.
Example
# Who am I, and in which account?
aws sts get-caller-identity
# { "UserId": "AROA...:alice", "Account": "111122223333",
# "Arn": "arn:aws:sts::111122223333:assumed-role/Admin/alice" }
# Account-level security checks
aws iam get-account-summary \
--query 'SummaryMap.[AccountMFAEnabled,AccountAccessKeysPresent]'
# [1, 0] -> root has MFA, root has no access keys (what you want)
# Generate the credential report: every user, key age and MFA status
aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | base64 -d | head -3Remember
- The account is the security and billing boundary
- Root: MFA on, no access keys, used only for root-only tasks
- AWS secures the infrastructure; you secure configuration, identities and data
Watch out for
- Running everyday tooling with root or a long-lived admin access key.