Protect the AWS Root Account and Turn on MFA

Every AWS account starts with one identity that can do everything: the root user. IAM policies cannot restrict it, so if someone gets in, there is no safety net. Before building anything else, lock it