[zrail]

Resetting the root password requires proving access to the email address associated with the root account. It also leaves a massive papertrail.

[akerl_]

By "massive papertrail" do you mean "a pair of emails to the associated address"?

[oneplane]

No, a massive amount of CloudTrail logs.

[akerl_]

Does it? Pretty sure that logging in as root generates one cloudtrail per action, regardless of whether or not you did it with a saved password or you reset the password. Resetting the password doesn't generate a cloudtrail event as far as I've seen.