Can resources be made hidden from root user?

Question

Is there a possibility that a root user can't see objects or resources created by IAM user? If yes, what a root user can do to access and review everything in the account?

Accepted Answer

If that resource allow resource based policy, then yes, root user can also be blocked to have access to those resources via explicit deny at resource level. In an org, root user in child accounts can also be blocked through SCP.

So, some of the places that you need to look at, are:

1. SCP
2. Resource based policy
3. Permissions boundary
4. Session policy

For example, one can deny access to root user to access a specific secrets manager via secret manager resource policy.

In theory, root user has access to everything but that can also be put in explicit deny via one of the above mentioned ways.

Answer

No, the root user in AWS has full administrative privileges and can see and access all resources within the account, including objects created by IAM (Identity and Access Management) users. By design, the root user has unrestricted access to the entire AWS environment and can review and manage all resources.

It's important to note that while the root user has broad access, it is generally recommended to follow the principle of least privilege and avoid using the root user for day-to-day tasks. Instead, it's recommended to create and use IAM users with specific permissions to perform regular tasks, and only rely on the root user for administrative actions that require unrestricted access.

Can resources be made hidden from root user?

Relevant content