AWS root user
The AWS root user is the highly privileged identity associated with an AWS account, distinct from its IAM users and roles, with authority to perform certain account tasks unavailable to ordinary administrators.
An administrator is not necessarily the root user
An IAM role with broad administrative permissions is still different from the account’s root identity. AWS reserves some account operations for root-level access and recommends using other identities for everyday work.
The account type and configuration matter. AWS Organizations supports centrally managing root access for member accounts, including removing their long-term root credentials and performing supported privileged tasks through an authorized management account or delegated administrator. Do not assume every account needs a usable root password stored somewhere.
AWS also documents service control policies that can restrict member-account root actions. “Root” does not mean every organizational control stops applying.
Recovery details are part of the security boundary
The root email address and recovery mechanisms deserve the same care as other privileged access. AWS recommends a business-managed group address dedicated to root credentials and restricted access to recovery channels.
Our root email change article explains why changing the inbox is an access decision. Receiving a verification message proves access to that inbox, not that the business approved the change.
Keep the account identifier, authorized owner, recovery contacts, and permitted procedure clear. If a change was unauthorized, use the containment review to track what access remains rather than assuming that restoring the email address closes the incident.