Exam AWS Certified Cloud Practitioner topic 1 question 20 discussion

Vote for B https://aws.amazon.com/premiumsupport/knowledge-center/change-support-plan/?nc1=h_ls

Vote for A. Amazon Doc says: Changing the AWS Support plan does not require root access. You can change the support plan for your AWS account using the AWS Support Plans console or the AWS CLI.

Changing the AWS Support plan requires root user credentials because it involves account-level changes, and only the root user can modify critical settings like the support plan. Viewing billing information can be done by users with appropriate permissions without needing the root user credentials. Starting and stopping Amazon EC2 instances can be performed by IAM users with the correct permissions; it does not require root user credentials. Opening an AWS Support case can be done by any user with the necessary permissions and does not require root user credentials.

B is not correct answer. A should be correct answer why? Because of the following AMS monitors root usage. We recommend that you use root only for the few tasks that require it, for example: changing your account settings, activating AWS Identity and Access Management (IAM) access to billing and cost management, changing your root password, and enabling multi-factor authentication (MFA).

Exam Pro content clearly indicates answer B

B: Change or cancel AWS Support Plan

Answer is B, because an IAM user can view billing information with correct permissions.

The answer is B: https://docs.aws.amazon.com/awssupport/latest/user/changing-support-plans.html You can use the AWS Support Plans console to change your support plan for your AWS account. To change your support plan, you must have AWS Identity and Access Management (IAM) permissions or sign in to your account as a root user. For more information, see Manage access to AWS Support Plans and AWS managed policies for AWS Support Plans.

It's Option A. Refer this document https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html. It has this task under the list 'View certain tax invoices. An IAM user with the aws-portal:ViewBilling permission can view and download VAT invoices from AWS Europe, but not AWS Inc. or Amazon Internet Services Private Limited (AISPL).'

I'm very confused on this one.. Looking at this doc - https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html I can't relate to any of provided options.. ;D

The task that requires using AWS account root user credentials is: B. Changing the AWS Support plan. Changing the AWS Support plan typically requires root user credentials because it involves modifying billing and support-related settings at the AWS account level. This task requires administrative privileges, which are associated with the root user of an AWS account.

Think of this as a cloud, platform, aws, devops, etc engineer working with AWS in a company environment. Show me a legitimate company that regularly wants basic view/list/describe on Billing to be isolated to the root account, which should almost NEVER be used. While the modify action on the company's/organization's AWS support plan (Enterprise Support plan is $15k/month MINIMUM) is regularly performed and should be shared via IAM roles or Identity Center's permission sets? That would make no sense. You'd even be getting your TAM reaching out to you if your company's AWS Support plan suddenly changed since it's such an impactful change. The answer is clearly B although this question appears to be a bit outdated since a root user technically can share BOTH functions with policy based users as of a few months ago.

last part of my comment - D. Opening an AWS Support case https://docs.aws.amazon.com/awssupport/latest/user/case-management.html You can create a support case in the Support Center of the AWS Management Console. ... sign in to Support Center as the root user of your AWS account or as an AWS Identity and Access Management (IAM) user.

reply continued - B. Changing the AWS Support plan https://docs.aws.amazon.com/awssupport/latest/user/changing-support-plans.html You can use the AWS Support Plans console to change your support plan for your AWS account. To change your support plan, you must have AWS Identity and Access Management (IAM) permissions or sign in to your account as a root user ---------------------------- C. Starting and stopping Amazon EC2 instances https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/get-set-up-for-amazon-ec2.html Set up to use Amazon EC2 ..... create an administrative user so that you don't use the root user for everyday tasks.

Emm!! - Sorry Guys but none of these answers A,B,C nor D appear to be correct ? Because once a non-root IAM user account is created and permissions given (by root), they can thereafter perform all the these tasks A, B, C & D But don't believe me - see what AWS say; - ------------- A. Viewing billing information https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-what-is.html By default, IAM users and roles in your account can't access the Billing and Cost Management console. To grant access, enable the Activate IAM Access setting. .... use AWS Identity and Access Management (IAM) to control who in your account or organization has access to specific pages on the Billing and Cost Management console

It's should be A ref: https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/control-access-billing.html#ControllingAccessWebsite-Activate

A is the answer It requires root access