AWS Account Setup

Accounts and Identities

An AWS account is the billing and isolation boundary: resources and charges belong to one account. The root user is the email and password used at signup. It has unrestricted access and cannot be limited by policy.

Daily access uses an IAM user with attached policies, created in AWS CLI Setup. This guide covers the account and the root user.

Use a personal account for this course. The account carries a payment method, and resources are created and deleted throughout the term.

Creating the Account

Sign up at aws.amazon.com. Required:

• Root email - Sign-in name for the root user; receives billing and security mail. Must remain reachable beyond the term.
• Account name - A label; changeable later.
• Contact information
• Payment method - Credit or debit card; required on both plans.
• Phone verification - SMS or voice.
• Support plan - Basic (free).
• Account plan - Free or Paid; see below.

Activation completes within minutes. Some services remain unavailable for up to 24 hours.

Account Plans

Both plans start with $100 in credits; activities in the console’s Explore AWS panel earn up to $100 more. Usage draws down credits at standard prices on either plan.

• Free plan - No charges. Selected services only. The account closes six months after opening or when credits are exhausted, whichever comes first.
• Paid plan - All services. Usage beyond the credits is billed to the card.

The Paid plan is recommended. The term and project approach the six-month limit, a closed account is unrecoverable after 90 days, and the budget alert below bounds charges. A Free-plan account can be upgraded at any time; a Paid-plan account cannot be downgraded.

Root User Security

Signed in as root:

MFA

MFA is required on the root user. AWS enforces registration within 35 days of first sign-in.

Account menu → Security credentials → Multi-factor authentication → Assign MFA device

• Passkey or security key - Recommended. A synced passkey in a password manager, a platform authenticator such as Touch ID, or a hardware key.
• Authenticator app - Any TOTP app.

A second registered device avoids account recovery through email and phone if the first is lost.

Access Keys

Root access keys are not created. They carry unrestricted access and cannot be limited. Programmatic access uses the IAM user’s key.

Contact Information

Account menu → Account. The phone number and root email are the MFA recovery path.

Account ID

The 12-digit account ID appears in the account menu and in every ARN:

arn:aws:iam::123456789012:user/ee547-cli
arn:aws:s3:::my-bucket

It is used in policies and in globally unique resource names such as S3 buckets. It identifies the account; it is not a credential.

Budget Alert

A budget sends email when spending crosses a threshold.

Billing and Cost Management → Budgets → Create budget → Use a template

• Zero spend budget - Alerts at $1 of actual spend.
• Monthly cost budget - A fixed monthly amount; alerts when actual or forecasted spend exceeds it.

Recipient: the root email. Budgets measure cost after credits; usage inside the credit balance reads as zero, and the alert fires once charges reach the card.

Under Billing preferences, enable AWS Free Tier alerts and CloudWatch billing alerts.

Creating a budget is an Explore AWS activity and earns credit.

Billing Console

Bills shows month-to-date charges by service. Credits shows the remaining balance.

By default only the root user can view billing. To allow the IAM user: Account → IAM user and role access to billing information → Activate.

End of Term

• Terminate instances and delete buckets and other billable resources. Stopped instances bill for attached volumes.
• Delete access keys no longer in use.
• An account with no resources incurs no charges. To close it: Account → Close account, signed in as root. Usage through the closure date is billed the following month. The account can be reopened within 90 days; after that it is permanently closed and the root email cannot be reused for a new account.