Root user vs IAM user in AWS - Visual Side-by-Side Comparison

Process Flow - Root user vs IAM user

Start: AWS Account Created

↓

Root User Created

↓

Create IAM Users

↓

Root User: Full Access

↓

IAM Users: Limited Access

↓

Use IAM Users for Daily Tasks

↓

Use Root User for Critical Tasks Only

This flow shows that the AWS account starts with a root user having full access. IAM users are created with limited permissions for daily use, while the root user is reserved for critical tasks.

Execution Sample

AWS

1. Login as root user
2. Create IAM user with limited permissions
3. IAM user tries to delete a resource
4. IAM user allowed or denied based on permissions
5. Root user performs account-wide changes

This sequence shows root user creation, IAM user creation, permission checks, and usage differences.

Process Table

Step	User Type	Action	Permission Check	Result
1	Root User	Login to AWS account	Full access	Success
2	Root User	Create IAM user with S3 read-only	Full access	Success
3	IAM User	Attempt to delete S3 bucket	Check IAM policy	Denied
4	IAM User	List S3 buckets	Check IAM policy	Allowed
5	Root User	Change account billing info	Full access	Success
6	IAM User	Change account billing info	Check IAM policy	Denied
7	Root User	Enable MFA on root account	Full access	Success
Exit	-	-	-	End of scenario

💡 Scenario ends after root and IAM user actions demonstrate permission differences.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	After Step 7	Final
User Permissions	Root: Full, IAM: None	Root: Full, IAM: S3 read-only	Root: Full, IAM: S3 read-only	Root: Full, IAM: S3 read-only	Root: Full, IAM: S3 read-only	Root: Full, IAM: S3 read-only	Root: Full with MFA, IAM: S3 read-only	Root: Full with MFA, IAM: S3 read-only

Key Moments - 3 Insights

Why can the IAM user list S3 buckets but not delete them?

Because the IAM user was given read-only permissions (Step 2), so listing is allowed (Step 4) but deleting is denied (Step 3) as shown in the execution_table.

Why should the root user be used only for critical tasks?

The root user has full access to everything (Step 1 and Step 5), so using it daily risks accidental or malicious changes. The execution_table shows root user doing sensitive tasks like billing changes (Step 5).

What is the benefit of enabling MFA on the root user?

Enabling MFA adds extra security to the root user (Step 7), reducing risk of unauthorized access, as reflected in the variable_tracker showing root user with MFA enabled.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the IAM user try to delete a resource and what is the result?

A Step 3, Denied

B Step 3, Allowed

C Step 4, Allowed

D Step 5, Denied

💡 Hint

Check the row with Step 3 in the execution_table under 'Result' column.

According to the variable_tracker, what permission does the IAM user have after Step 2?

A Full access

B S3 read-only

C No access

D Billing access

💡 Hint

Look at the 'IAM' permissions in the variable_tracker after Step 2.

If the root user did not have MFA enabled, which step in the execution_table would be missing?

A Step 5

B Step 3

C Step 7

D Step 1

💡 Hint

Step 7 shows enabling MFA on root user in the execution_table.

Concept Snapshot

Root user: The original AWS account owner with full access.
IAM users: Created by root user with limited permissions.
Use IAM users for daily tasks to reduce risk.
Root user reserved for critical tasks like billing or security.
Enable MFA on root user for extra protection.

Full Transcript

This visual execution shows the difference between AWS root user and IAM users. The root user is created when the AWS account is made and has full access to everything. IAM users are created by the root user and given limited permissions, such as read-only access to S3. The execution table traces actions like login, creating users, and permission checks. IAM users can perform allowed actions but are denied restricted ones. The root user can perform all actions including sensitive ones like changing billing info. Enabling MFA on the root user adds security. The variable tracker shows how permissions change over steps. Key moments clarify why IAM users have limited access and why root user use should be limited. The quiz tests understanding of permission checks and security best practices.