3 ms·
The article says "You" so I'll put aside for a moment the situation where there are three admins and they should all have their own account. Great! Now Sto
by technion 9y ago
The article says "You" so I'll put aside for a moment the situation where there are three admins and they should all have their own account.
Great! Now Stop Using Your Root Account
If you can make an unprivileged account for general use, great! Separation of privs is an awesome thing. But if you're going to make an IAM account with AdministratorAccess and BillingAccess as described, how is that any safer to use than the root account? I see this a lot and I'm quite interested in the reasoning.
I've also found that certain forms - like the Penetration Test permission form, must be done as root. So you need to use the account occasionally even if you don't want to.
- minnusox 9y agoThe root account has no restrictions whatsoever, but you as an admin IAM user can block yourself from e.g. deleting DynamoDB tables to make accidental deletion harder: https://aws.amazon.com/blogs/database/preventing-accidental-table-deletion-in-dynamodb/ https://aws.amazon.com/blogs/database/preventing-accidental-...
- kylegalbraith 9y agoYes there are still some things you need root for. PEN test is definitely one of them. But at least configure your root account to be very hard to get into. You are correct if you are in organization that needs multiple admins you would create multiple accounts.