For what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges. Last I checked (and by that I mean found out th

For what it's worth, unless something's changed those accounts have admin privileges but _not_ root privileges. Last I checked (and by that I mean found out the hard way) there are still places across AWS that you can lock everyone but root out of. Particularly it seems around a few of the places where you're configuring policies on specific resources rather than through IAM. We ended up setting a policy on an S3 bucket that locked everyone out. The root account _always_ has permissions to edit/remove that policy, but the policy itself prevented the admin accounts from removing it.