diff --git a/s3tests.conf.SAMPLE b/s3tests.conf.SAMPLE
index 60e9928..550e806 100644
--- a/s3tests.conf.SAMPLE
+++ b/s3tests.conf.SAMPLE
@@ -135,6 +135,13 @@ secret_key = abcdefghijklmnopqrstuvwxyzabcdefghijklmn
 #display_name from vstart.sh
 display_name = youruseridhere
 
+# iam account root user for iam_account tests
+[iam root]
+access_key = AAAAAAAAAAAAAAAAAAaa
+secret_key = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+user_id = RGW11111111111111111
+email = account1@ceph.com
+
 #following section needs to be added when you want to run Assume Role With Webidentity test
 [webidentity]
 #used for assume role with web identity test in sts-tests
diff --git a/s3tests_boto3/functional/__init__.py b/s3tests_boto3/functional/__init__.py
index 1162cc8..edf062c 100644
--- a/s3tests_boto3/functional/__init__.py
+++ b/s3tests_boto3/functional/__init__.py
@@ -266,6 +266,10 @@ def setup():
     config.iam_user_id = cfg.get('iam',"user_id")
     config.iam_email = cfg.get('iam',"email")
 
+    config.iam_root_access_key = cfg.get('iam root',"access_key")
+    config.iam_root_secret_key = cfg.get('iam root',"secret_key")
+    config.iam_root_email = cfg.get('iam root',"email")
+
     # vars from the fixtures section
     template = cfg.get('fixtures', "bucket prefix", fallback='test-{random}-')
     prefix = choose_bucket_prefix(template=template)
@@ -439,6 +443,17 @@ def get_iam_s3client(**kwargs):
                           **kwargs)
     return client
 
+def get_iam_root_client(**kwargs):
+    kwargs.setdefault('service_name', 'iam')
+    kwargs.setdefault('aws_access_key_id', config.iam_root_access_key)
+    kwargs.setdefault('aws_secret_access_key', config.iam_root_secret_key)
+
+    return boto3.client(endpoint_url=config.default_endpoint,
+                        region_name='',
+                        use_ssl=config.default_is_secure,
+                        verify=config.default_ssl_verify,
+                        **kwargs)
+
 def get_alt_client(client_config=None):
     if client_config == None:
         client_config = Config(signature_version='s3v4')
@@ -700,6 +715,9 @@ def get_iam_access_key():
 def get_iam_secret_key():
     return config.iam_secret_key
 
+def get_iam_root_email():
+    return config.iam_root_email
+
 def get_user_token():
     return config.webidentity_user_token