Exam AWS Certified Cloud Practitioner topic 1 question 20 discussion

Vote for B https://aws.amazon.com/premiumsupport/knowledge-center/change-support-plan/?nc1=h_ls

Vote for A. Amazon Doc says: Changing the AWS Support plan does not require root access. You can change the support plan for your AWS account using the AWS Support Plans console or the AWS CLI.

You don't need root access to change support plan

he correct answer is: A. Viewing billing information Justification: The AWS account root user has full access to all AWS resources and services, including tasks that involve account-level management. Some actions that require the root user credentials include: Viewing billing information Changing AWS account settings (such as email or payment method) Managing AWS account permissions Why Not the Other Options? B. Changing the AWS Support plan → Changing the AWS Support plan can be done by an IAM user with appropriate permissions, not necessarily the root user. C. Starting and stopping Amazon EC2 instances → This task can be done by IAM users with the appropriate permissions, so it doesn’t require root user access. D. Opening an AWS Support case → AWS Support cases can be opened by IAM users if they have the necessary permissions, so the root user is not required.

All others can be done by other IAM users/roles.

Visualización de la información de facturación: El usuario raíz es la única cuenta que puede acceder a la información de facturación de la cuenta de AWS, sin posibilidad de delegar este permiso a otros usuarios a través de IAM. Cambio del plan de soporte: No se requiere necesariamente el usuario raíz. Un usuario IAM con permisos administrativos puede realizar esta acción si se le conceden los permisos adecuados.

Viewing billing information

Changing the AWS Support plan requires root user credentials because it involves account-level changes, and only the root user can modify critical settings like the support plan. Viewing billing information can be done by users with appropriate permissions without needing the root user credentials. Starting and stopping Amazon EC2 instances can be performed by IAM users with the correct permissions; it does not require root user credentials. Opening an AWS Support case can be done by any user with the necessary permissions and does not require root user credentials.

B is not correct answer. A should be correct answer why? Because of the following AMS monitors root usage. We recommend that you use root only for the few tasks that require it, for example: changing your account settings, activating AWS Identity and Access Management (IAM) access to billing and cost management, changing your root password, and enabling multi-factor authentication (MFA).

Exam Pro content clearly indicates answer B

B: Change or cancel AWS Support Plan

Answer is B, because an IAM user can view billing information with correct permissions.

The answer is B: https://docs.aws.amazon.com/awssupport/latest/user/changing-support-plans.html You can use the AWS Support Plans console to change your support plan for your AWS account. To change your support plan, you must have AWS Identity and Access Management (IAM) permissions or sign in to your account as a root user. For more information, see Manage access to AWS Support Plans and AWS managed policies for AWS Support Plans.

It's Option A. Refer this document https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html. It has this task under the list 'View certain tax invoices. An IAM user with the aws-portal:ViewBilling permission can view and download VAT invoices from AWS Europe, but not AWS Inc. or Amazon Internet Services Private Limited (AISPL).'

I'm very confused on this one.. Looking at this doc - https://docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html I can't relate to any of provided options.. ;D

The task that requires using AWS account root user credentials is: B. Changing the AWS Support plan. Changing the AWS Support plan typically requires root user credentials because it involves modifying billing and support-related settings at the AWS account level. This task requires administrative privileges, which are associated with the root user of an AWS account.

Think of this as a cloud, platform, aws, devops, etc engineer working with AWS in a company environment. Show me a legitimate company that regularly wants basic view/list/describe on Billing to be isolated to the root account, which should almost NEVER be used. While the modify action on the company's/organization's AWS support plan (Enterprise Support plan is $15k/month MINIMUM) is regularly performed and should be shared via IAM roles or Identity Center's permission sets? That would make no sense. You'd even be getting your TAM reaching out to you if your company's AWS Support plan suddenly changed since it's such an impactful change. The answer is clearly B although this question appears to be a bit outdated since a root user technically can share BOTH functions with policy based users as of a few months ago.