1. None. It isn't recommended to keep using the root account for any other case than emergency access to the account.
2. MFA is the procedure of entering multiple authentication factors when logging in – for example, a username will require the user's password and a Time-based One-time Password (TOTP) or certificate to authenticate.

3. Set the minimum password length; require at least one uppercase or lowercase character; number or special character; allow users to change their own passwords; enable password expiration after a number of days; prevent the reuse of passwords, enable administrative reset on expired passwords.
4. Users, Groups, Roles, and Policies.
5. Yes.
6. You can't retrieve an existing secret access key. A new key needs to be created.
7. Create a role with the appropriate S3 access...