Lab: an AWS account that cannot surprise you

Before you start

Every later lab in this course assumes you have done this one. You set up one AWS account: a container for everything you create in AWS, with its own bill and its own users.

What it costs: this lab costs nothing on either plan. IAM, IAM Identity Center, AWS Organizations and AWS Budgets alerts have no charge. AWS may hold a small amount on your card for a few days to verify it.

What you need:

• An email address that is not already linked to an AWS account. A personal address is best; never use a work account for this course.
• A mobile phone for the sign-up check.
• A payment card. On the free plan it cannot be charged unless you upgrade.
• An authenticator app on your phone (any app that shows six-digit codes), a passkey or a security key, for multi-factor authentication (MFA): a second proof of identity on top of your password.

No account? Read each step and its “what you will see” notes. The AWS Free Tier page shows the plans, and the IAM guide page Enable a virtual MFA device for the root user has screenshots of the MFA steps. You can answer every question below without an account.

Step 1: create the account and choose a plan

1. Go to the AWS Free Tier page and choose the button to create a free account.
2. Enter your email address and a name for the account, such as cloud-practitioner-study. Confirm the code AWS emails you.
3. Set a strong password. This email and password are the root user: the one identity that can do anything in the account, including closing it.
4. Enter your contact details, choose a plan (see below), add the card and finish the phone check.

What changed recently (July 2025): accounts created from 15 July 2025 choose between a free plan and a paid plan. Both receive USD 100 in credits at sign-up and can earn up to USD 100 more by trying set activities; creating a cost budget, as you will in step 4, is one of them. Accounts created before that date keep the older Free Tier with its twelve-month offers. Always-free offers continue under both. Sources: AWS News Blog, Choosing a plan.

	Free plan	Paid plan
Charges	None until you upgrade	Pay-as-you-go for anything the credits do not cover
Services	A selection; services that could use up the credits quickly, such as Savings Plans and Reserved Instances, are not available	All services
How long	Six months or until the credits are used, whichever is first	No end
At the end	The account closes. AWS keeps your content for 90 days, and you can upgrade within that time to keep it	Nothing changes
Moves to paid automatically if you	Join AWS Organizations, set up an AWS Control Tower landing zone, and a few other business steps	Already paid

Which should you pick? For most learners, the free plan: nothing in this course needs more, and it cannot bill you. Choose the paid plan if you expect to need more than six months, or want to follow step 3 with IAM Identity Center exactly as AWS recommends. You can upgrade from free to paid at any time, but not go back.

What you will see: the console home page, and on the Billing and Cost Management home page, your credit balance and plan.

Watch out: AWS is releasing a new sign-up experience to a limited number of customers, which organises your work into projects managed in AWS Settings. If your console offers Manage projects, some identity steps below differ; follow AWS’s guide for that experience.

Step 2: protect the root user with MFA

1. Sign in to the console as the root user (choose Root user and enter your email address, then your password).
2. On the right of the top bar, choose your account name, then Security credentials.
3. In the Multi-factor authentication (MFA) section, choose Assign MFA device.
4. Type a device name, choose the device type (Authenticator app for a phone app; a passkey or security key resists phishing even better) and choose Next.
5. For an app: choose Show QR code, scan it, then type two codes in a row into MFA code 1 and MFA code 2 and choose Add MFA.
6. Still on this page, look at Access keys. A new account has none. If any exist, delete them: the root user should never have access keys.

AWS has required MFA on the root user of every kind of account since June 2025 (announcement), so you may already have been asked to set it up. Keep a backup: you can add up to eight MFA devices, and adding a second one avoids a lock-out if you lose your phone.

What you will see: the MFA section lists your device.

Step 3: a day-to-day sign-in that is not the root user

The root user cannot be limited by any permission, so it should do only the handful of jobs that need it (such as closing the account). For everything else you want your own identity.

First, while still signed in as root, let identities other than root see billing, which you need in step 4:

1. Choose your account name at the top right, then Account.
2. Find IAM User and Role Access to Billing Information and choose Edit.
3. Select Activate IAM Access and choose Update.

Now choose A or B.

Watch out: enabling IAM Identity Center on an account that is not yet in an organization creates an organization. AWS’s Identity Center guide says that on a free-tier account this upgrades the account to the paid plan and the free tier credits expire immediately. If you chose the free plan and want to keep it, use B.

A: IAM Identity Center (paid plan, AWS’s recommended way)

IAM Identity Center gives people one sign-in page, the AWS access portal, and short-lived credentials through a permission set (a named bundle of permissions).

1. In the search bar, open IAM Identity Center and choose Enable.
2. If asked how to configure the instance, choose a single-Region instance. (The multi-Region option creates a KMS key that is charged.)
3. On the page about enabling it with AWS Organizations, choose Enable. Your account becomes the management account of a new organization.
4. Under Users, add a user for yourself with your email address, and choose to send an email with password set-up instructions.
5. Under Permission sets, create a permission set from the predefined AdministratorAccess policy. In a personal learning account you need broad rights; in real accounts you would grant less.
6. Under AWS accounts, select your account, choose Assign users or groups, pick your user, pick the permission set and finish.
7. Accept the invitation email, set a password and register MFA when asked.
8. Copy the AWS access portal URL from the Identity Center dashboard and bookmark it.

What you will see: in the access portal, your account with an AdministratorAccess link that opens the console.

B: an IAM user with MFA (free plan)

1. Open IAM and choose Users, then Create user.
2. Enter a user name, such as study-admin, and select the option to give the user access to the AWS Management Console. When asked what kind of user, choose to create an IAM user (the other option is Identity Center, which is path A).
3. Set a password of your own and continue.
4. On the permissions page, choose Add user to group, then Create group. Name it Admins, attach AdministratorAccess, create it, and select it.
5. Create the user. Copy the console sign-in URL shown at the end.
6. Open the user, choose the Security credentials tab and assign an MFA device, as in step 2.

What you will see: signing in at the sign-in URL asks for the user name, password and an MFA code, and the top bar shows study-admin.

From now on, sign out of root and use your new identity for everything.

Step 4: a budget that warns you

Signed in with your new identity:

1. Open Billing and Cost Management and choose Budgets, then Create budget.
2. Under Budget setup, choose Use a template (simplified).
3. Under Templates, choose Monthly cost budget: it notifies you if you exceed, or are forecast to exceed, the amount you set.
4. Give it a name, such as monthly-study-budget, and enter an amount you are comfortable with (a few US dollars is plenty for this course).
5. Enter your email address as the recipient and choose Create budget.

What you will see: the budget in the list, with its amount and its current spend (near zero). Its first figures can take up to a day to appear.

On the free plan you cannot be charged, but the budget still shows when usage is eating into your credits. AWS also sends free-plan accounts periodic emails about the credit balance and when the plan is close to ending.

Tip: The Zero spend budget template is a good second budget on the paid plan. It emails you as soon as anything is spent beyond the Free Tier.

Check your work

• You know which plan your account is on, and when the free plan ends if you chose it.
• The root user has an MFA device and no access keys.
• You can sign in through the access portal (A) or as your IAM user with MFA (B), and you have signed out of root.
• Budgets lists your monthly cost budget with your email as the recipient.

Clean up

This lab creates the safety net for the whole course, so keep everything: the MFA device, your day-to-day identity and the budget. None of them cost anything.

When you finish the course:

1. Delete the budget from Budgets.
2. Delete the lab resources each later lab tells you to (they each clean up as they go).
3. If you no longer need the account, sign in as root, choose your account name, then Account, and close it. A free-plan account also closes by itself when the plan ends.

Exam tips

• “Secure the root user” → MFA on root, no root access keys, and use it only for root-only tasks.
• “Give people access to AWS accounts with single sign-on” → IAM Identity Center.
• “Get an email when spending is likely to pass a limit” → AWS Budgets with a forecasted alert. Budgets warns; it does not stop spending unless you configure an action.
• “Least privilege” means granting only the permissions a job needs. The AdministratorAccess used here is fine in a personal learning account, never as a default elsewhere.
• Know the July 2025 Free Tier: free plan or paid plan, credits for both, and always-free offers continue.