Creating and securing an AWS account

What an AWS account is

An AWS account is a container that holds your resources (servers, buckets, databases) and receives one bill. Companies often use many accounts, for example one for development and one for production, so a mistake in one cannot damage the other. As a learner, one account is enough. Each account has a 12-digit account ID such as 123456789012.

Signing up

1. Go to aws.amazon.com and choose to create an account. Use an email address you will keep for years; a shared team mailbox is better than a personal one for a company account.
2. Enter contact details and a payment card. Indian debit and credit cards usually work; a small temporary verification charge may appear and is reversed.
3. Verify your phone number, then choose a plan (see the Free Tier below) and the free Basic support plan.

The Free Tier (it changed in July 2025)

For accounts created on or after 15 July 2025, AWS asks you to choose a Free plan or a Paid plan. New customers get up to US$200 in credits: US$100 at sign-up, and up to US$100 more for trying certain services. The Free plan lasts up to 6 months or until the credits run out, whichever comes first, and some services are not available on it; to keep going you upgrade to the Paid plan. Some "always free" offers continue on both plans, for example AWS Lambda's 1 million requests and 400,000 GB-seconds of compute per month. Accounts opened before 15 July 2025 keep the older 12-month free tier. These rules change, so read the current AWS Free Tier page before you rely on any number here.

The root user: lock it away

The root user is the identity created with your sign-up email. It has complete access to everything in the account, and IAM permission policies cannot limit it. If someone steals the root password, they own your account and your bill. So:

• Turn on MFA (multi-factor authentication) for root immediately: an authenticator app, a passkey or a hardware security key. AWS now requires MFA for root users in most accounts, but set it up on day one anyway.
• Never create access keys for the root user. If any exist, delete them.
• Use a long, unique password stored in a password manager.
• Use root only for the few tasks that need it, such as changing the account email or root password, closing the account, or restoring access when every admin is locked out.

An admin identity for daily work

For everyday work, create a separate identity with admin rights. The recommended way for people is IAM Identity Center: it gives you a sign-in portal and short-term credentials that expire on their own. For a personal learning account, an IAM user with the AdministratorAccess policy and MFA is acceptable and simpler. Either way, sign out of root and sign in as this identity.

Billing alerts before anything else

Open the Billing and Cost Management console and create a budget in AWS Budgets, for example a monthly cost budget of US$5 that emails you at 80% of actual spend and at 100% of forecast spend. AWS also offers a zero-spend budget template that warns you as soon as anything is charged. Do this before you launch your first server.

Four ways to use AWS

• The Management Console: the website. Good for learning and for looking around.
• The AWS CLI (command line interface): the aws command. Good for repeatable work and scripts.
• SDKs (software development kits): libraries for programming languages, such as boto3 for Python. Your apps use these.
• AWS CloudShell: a terminal in the browser, already signed in as you, with the CLI installed. No keys on your laptop.

aws --version                    # check the CLI (version 2) is installed
aws configure                    # asks for access key ID, secret key, region, output
# Default region name [None]: ap-south-1
# Default output format [None]: json

aws sts get-caller-identity      # who am I? (account ID and ARN)
aws s3 ls                        # list your S3 buckets

aws configure --profile learning # save a second set of settings as a named profile
aws s3 ls --profile learning     # use that profile for one command
aws configure sso                # set up a profile that signs in through IAM Identity Center

{
    "UserId": "AIDASAMPLEUSERID12345",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/asha-admin"
}

import boto3   # pip install boto3 (runs on your computer, not in this browser)

s3 = boto3.client("s3", region_name="ap-south-1")
for bucket in s3.list_buckets()["Buckets"]:
    print(bucket["Name"])