Has full control over AWS Account that it belongs to and all created in that account. Can’t be restricted.