The general advice for an AWS root account is to generate a random password and protect it with at least 2 hardware security keys for 2FA. Put one key in a safe (there are good gun safes with biometric access and access logs) and the other as backup in a safety deposit box.