We create a root user, but then don't auth as the user so there's no need to create it. There is a comment that says "Add a root user that is unauthorized to run the command" which is misleading, because it makes it hard to understand why the command then succeeds a few lines later (it's because we're already authenticated as the internal user, who is allowed to run this command, and not as the root user).