As a conman scumbag cloud wouldn't you make sure at have a much access as possible and have none of the actions (and maybe nobody else for extra confusion) logged in (if forced too in a super ephemeral). Root credentials would be stored only in yellow sticky notes.
