Exercise 1: Why Not Use the Root Account Day to Day? — Possible Solution
====================================================================

The root account's own unlimited permissions are exactly the problem,
not a convenience. Because it can do literally anything in the
account -- including closing the account, changing billing, and
deleting every other identity and resource in it -- a single
compromised root credential (a leaked password, a phished MFA code)
hands an attacker total, unrestricted control with no real ceiling on
the damage.

An individually named IAM user or role, by contrast, is bounded by
whatever specific policies are attached to it. If that identity's own
credentials are compromised instead, the real damage is limited to
whatever that identity was actually permitted to do -- which, if
least privilege has been applied, is far narrower than "everything."

ANSWER: The root account isn't avoided because it lacks capability --
it's avoided BECAUSE of its capability. Using a separate, narrowly-
scoped IAM identity for real day-to-day work means a single
compromised credential has a real, bounded blast radius, rather than
exposing the entire account to total compromise.

WHY THIS WORKS AS AN ANSWER
------------------------------
This correctly identifies that the recommendation isn't about the
root account being unreliable or hard to use, but about minimizing
the real consequences of any single credential eventually being
compromised -- directly connecting the root-account guidance to the
chapter's own later principle of least privilege, rather than treating
them as two unrelated rules.