Differences between the Root user and users with AdministratorAccess in AWS

Question

I am trying to determine the differences (if any) between using the AWS Root user, or a user within the AdministratorAccess group in AWS. The AdministratorAccess is given the following privileges:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}

Does this mean the users in the AdministratorAccess group can do everything that the Root user can do?

Answer 1

Does this mean the users in the AdministratorAccess group can do everything that the Root user can do?

Yes, barring the fact that IAM users with admin rights cannot delete root, while root obviously can delete any IAM users.

The root user generally should not be used for anything but creating an IAM user with admin rights. This should be then used for everything else.

Answer 2

There a few things that the root account can do that an Admin IAM user cannot but you're unlikely to run into them on a daily basis:

• Account management, particularly things like closing an account or changing the support tier.
• In some support tickets, the agents will refuse to talk to anyone other than the root user.
• Enable IAM billing access, this is a once per account setting that only the root user can enable which allows access to the billing information to IAM users.
• It is possible to trap yourself using DENY permissions, the example that comes to mind is setting a DENY all to everyone on an s3 bucket policy. This will prevent admin IAM users from deleting the bucket or even changing the policy. Only the root user can overrule this sort of thing.
• Enable opt-in settings like resource id length changes for the entire account.

I found an official list that covers most of the above in more detail: https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html