AWS SQS Policy not restricting root user

Question

I created some SQS queues as a root user. - Now when I like to restrict access via policies it does not seem to work. - Even with a test policy like this

{
  "Version": "2008-10-17",
  "Id": "PolicyDenyTest",
  "Statement": [
    {
      "Sid": "DenyIt",
      "Effect": "Deny",
      "Principal": "*",
      "Action": [
        "sqs:DeleteMessage",
        "sqs:ReceiveMessage",
        "sqs:SendMessage"
      ],
      "Resource": "arn:aws:sqs:us-west-2:xxxxxxxxxx:TST"
    }
  ]
}

I can still send/retrieve/delete messages from the queue from my local machine. - Are policies only valid when creating queues with an IAM user?

Answer 1

The credentials of the account owner allow full access to all resources in the account. You cannot use IAM policies to explicitly deny the root user access to resources. You can only use an AWS Organizations service control policy (SCP) to limit the permissions of the root user. Because of this, we recommend that you create an IAM user with administrator permissions to use for everyday AWS tasks and lock away the access keys for the root user.

https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html

The root key is all-powerful key that can be used to recover everything even if you mistakenly deny all access to all your resources. This is a well thought-out decision that is explained in the linked doc