Root user vs IAM user in AWS - Visual Side-by-Side Comparison

Process Flow - Root user vs IAM user

Start: AWS Account Created

↓

Root User Created

↓

Create IAM Users

↓

Root User: Full Access

↓

IAM Users: Limited Access

↓

Use IAM Users for Daily Tasks

↓

Use Root User for Critical Tasks Only

This flow shows that the AWS account starts with a root user having full access. IAM users are created with limited permissions for daily use, while the root user is reserved for critical tasks.

Execution Sample

AWS

1. Login as root user
2. Create IAM user with limited permissions
3. IAM user tries to delete a resource
4. IAM user allowed or denied based on permissions
5. Root user performs account-wide changes

This sequence shows root user creation, IAM user creation, permission checks, and usage differences.

Process Table

Step	User Type	Action	Permission Check	Result
1	Root User	Login to AWS account	Full access	Success
2	Root User	Create IAM user with S3 read-only	Full access	Success
3	IAM User	Attempt to delete S3 bucket	Check IAM policy	Denied
4	IAM User	List S3 buckets	Check IAM policy	Allowed
5	Root User	Change account billing info	Full access	Success
6	IAM User	Change account billing info	Check IAM policy	Denied
7	Root User	Enable MFA on root account	Full access	Success
Exit	-	-	-	End of scenario

💡 Scenario ends after root and IAM user actions demonstrate permission differences.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	After Step 7	Final
User Permissions	Root: Full, IAM: None	Root: Full, IAM: S3 read-only	Root: Full, IAM: S3 read-only	Root: Full, IAM: S3 read-only	Root: Full, IAM: S3 read-only	Root: Full, IAM: S3 read-only	Root: Full with MFA, IAM: S3 read-only	Root: Full with MFA, IAM: S3 read-only

Key Moments - 3 Insights

Why can the IAM user list S3 buckets but not delete them?

Because the IAM user was given read-only permissions (Step 2), so listing is allowed (Step 4) but deleting is denied (Step 3) as shown in the execution_table.

Why should the root user be used only for critical tasks?

The root user has full access to everything (Step 1 and Step 5), so using it daily risks accidental or malicious changes. The execution_table shows root user doing sensitive tasks like billing changes (Step 5).

What is the benefit of enabling MFA on the root user?

Enabling MFA adds extra security to the root user (Step 7), reducing risk of unauthorized access, as reflected in the variable_tracker showing root user with MFA enabled.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the IAM user try to delete a resource and what is the result?

A Step 3, Denied

B Step 3, Allowed

C Step 4, Allowed

D Step 5, Denied

💡 Hint

Check the row with Step 3 in the execution_table under 'Result' column.

According to the variable_tracker, what permission does the IAM user have after Step 2?

A Full access

B S3 read-only

C No access

D Billing access

💡 Hint

Look at the 'IAM' permissions in the variable_tracker after Step 2.

If the root user did not have MFA enabled, which step in the execution_table would be missing?

A Step 5

B Step 3

C Step 7

D Step 1

💡 Hint

Step 7 shows enabling MFA on root user in the execution_table.

Concept Snapshot

Root user: The original AWS account owner with full access.
IAM users: Created by root user with limited permissions.
Use IAM users for daily tasks to reduce risk.
Root user reserved for critical tasks like billing or security.
Enable MFA on root user for extra protection.

Full Transcript

This visual execution shows the difference between AWS root user and IAM users. The root user is created when the AWS account is made and has full access to everything. IAM users are created by the root user and given limited permissions, such as read-only access to S3. The execution table traces actions like login, creating users, and permission checks. IAM users can perform allowed actions but are denied restricted ones. The root user can perform all actions including sensitive ones like changing billing info. Enabling MFA on the root user adds security. The variable tracker shows how permissions change over steps. Key moments clarify why IAM users have limited access and why root user use should be limited. The quiz tests understanding of permission checks and security best practices.

Practice

1. Which AWS user has full access to all resources and billing information by default?

easy

A. IAM user with admin permissions

B. Federated user

C. IAM user with read-only permissions

D. Root user

Solution

1. Step 1: Understand AWS user types

   The root user is the original account owner with full control over all AWS services and billing.

2. Step 2: Compare with IAM users

   IAM users have permissions assigned and do not have full access by default.

3. Final Answer:

   Root user -> Option D

4. Quick Check:

   Full access = Root user [OK]

Hint: Root user = full control, IAM users = limited [OK]

Common Mistakes:

• Confusing IAM admin user with root user
• Thinking IAM users have full billing access by default
• Assuming federated users have root privileges

2. Which of the following is the correct way to create an IAM user in AWS Management Console?

easy

A. Use AWS Billing dashboard to add a user

B. Go to IAM > Users > Add user, then set permissions

C. Log in as root user and create a new AWS account

D. Create a new user under AWS Organizations

Solution

1. Step 1: Locate IAM user creation

   IAM users are created in the IAM service under Users > Add user.

2. Step 2: Understand permissions assignment

   After adding a user, you assign permissions directly or via groups.

3. Final Answer:

   Go to IAM > Users > Add user, then set permissions -> Option B

4. Quick Check:

   IAM user creation = IAM console [OK]

Hint: Create IAM users only in IAM console, not billing or orgs [OK]

Common Mistakes:

• Trying to create IAM users in Billing dashboard
• Confusing AWS Organizations with IAM user creation
• Creating new AWS accounts instead of IAM users

3. If an IAM user tries to delete an S3 bucket but gets an Access Denied error, what is the most likely reason?

medium

A. The IAM user does not have delete permissions for the bucket

B. The root user disabled S3 service

C. The bucket is owned by another AWS account

D. IAM users cannot delete S3 buckets

Solution

1. Step 1: Check IAM user permissions

   IAM users need explicit permissions to delete S3 buckets; lacking these causes Access Denied.

2. Step 2: Evaluate other options

   Root user cannot disable S3 service; buckets owned by others can cause issues but usually different errors; IAM users can delete buckets if permitted.

3. Final Answer:

   The IAM user does not have delete permissions for the bucket -> Option A

4. Quick Check:

   Access Denied = missing permissions [OK]

Hint: Access Denied usually means missing permission, not service disabled [OK]

Common Mistakes:

• Assuming root user disables services
• Believing IAM users cannot delete buckets at all
• Ignoring bucket ownership issues

4. An administrator accidentally used the root user credentials for daily tasks and now wants to improve security. What should they do to fix this?

medium

A. Create IAM users with appropriate permissions and avoid using root user for daily tasks

B. Delete the root user and use only IAM users

C. Share root user credentials with team members for convenience

D. Disable MFA on root user to simplify login

Solution

1. Step 1: Understand root user best practices

   Root user should be used only for account setup and billing, not daily tasks.

2. Step 2: Implement IAM users for daily work

   Create IAM users with limited permissions for daily tasks to improve security.

3. Final Answer:

   Create IAM users with appropriate permissions and avoid using root user for daily tasks -> Option A

4. Quick Check:

   Use IAM users daily, root only for emergencies [OK]

Hint: Use IAM users daily; keep root user locked down [OK]

Common Mistakes:

• Trying to delete root user (impossible)
• Sharing root credentials widely
• Disabling MFA on root user

5. A company wants to restrict billing access to only the root user but allow IAM users to manage resources. Which AWS best practice should they follow?

hard

A. Create IAM users with billing permissions and avoid using root user

B. Grant all IAM users full admin access including billing

C. Use the root user only for billing and create IAM users with resource permissions

D. Disable root user and use IAM users for all tasks

Solution

1. Step 1: Understand billing access control

   Billing access is sensitive and should be limited to the root user for security.

2. Step 2: Assign resource management to IAM users

   IAM users should have permissions to manage resources but not billing.

3. Final Answer:

   Use the root user only for billing and create IAM users with resource permissions -> Option C

4. Quick Check:

   Billing = root only; resource management = IAM users [OK]

Hint: Keep billing to root user; IAM users manage resources [OK]

Common Mistakes:

• Giving IAM users billing permissions unnecessarily
• Disabling root user (not possible)
• Granting full admin to all IAM users