IAM Best Practices:

Only use root account to create the account. Then create users to login. One user = one human. Apply policies to groups of users, not individual users. Have a strong password rotation policy. Always enable MFA wherever possible. Using roles is better than access keys.