Day 2Security · Lab⏱ 1.5h

Create and Lock Down Your AWS Account

By the end of today you can Have a secured AWS account: root user locked with MFA, a daily-use admin identity, and a budget alarm that emails you before costs get out of hand.

1. First principles: whose key is this?

When you sign up you create the root user, logged in with your email address. It can do anything, including closing the account, and its permissions cannot be restricted. If someone steals it, they can mine crypto on your credit card within minutes. It happens daily to beginners.

Analogy: the master keyThe root user is the building master key. You keep it in a safe (strong password + MFA) and almost never use it. For daily work you cut a normal key (an admin user or role) that can be disabled if lost.

Lock away the root key; work through a limited identity.

2. Lab

Cost safetyYou will need a credit/debit card. Do the budget step (5) today and never post keys, passwords or account IDs publicly.

Sign up at aws.amazon.com → "Create an AWS account". Use an email you will keep for years. Choose the free plan if offered (it caps spending with credits). Read its current terms.
Secure root: sign in as root → top-right account menu → Security credentials → Assign MFA device → Authenticator app (Google Authenticator, Authy…). Scan the QR, enter two consecutive codes. Save recovery info offline.
Never create root access keys. If any exist, delete them.
Create your daily admin. Easiest for a beginner: IAM → Users → Create user (yourname-admin), tick "Provide console access", attach policy AdministratorAccess (via a group Admins), then enable MFA on this user too. (Later you'll learn IAM Identity Center, the recommended long-term approach.)
Budget alarm: Billing and Cost Management → Budgets → Create budget → "Zero spend budget" template (alerts the moment you're charged anything) + a second monthly cost budget of $10 with alerts at 80% and 100%. Add your email.
Enable IAM billing access (Account page → "IAM user and role access to Billing information" → Activate) so your admin can see bills without root.
Sign out of root. Sign in via the IAM user sign-in URL (shown on the IAM dashboard; bookmark it). Choose a default region near you and stay on it.

📸 Evidence (blur account ID/email): evidence/day02-root-mfa-enabled.png, evidence/day02-budget-created.png

3. Why each step matters

Step	Threat it stops
Root MFA	Stolen password = stolen account
No root keys	Keys leak on GitHub and get abused in minutes
Admin user ≠ root	You can deactivate a compromised user; you can't "deactivate" root
Budgets	Forgotten resources and surprise bills

4. Exam notes

Remember

Tasks only root can do: change account settings/support plan, close the account, restore IAM permissions of an admin who locked themselves out, etc.
MFA = something you know + something you have.
AWS Budgets = alert on cost/usage thresholds. Cost Explorer = visualize and analyze past spend. Billing alarms use CloudWatch.

5. Quiz

Q1. Best practice for the root user?

Enable MFA, don't create access keys, don't use it for daily tasks.

Q2. Which service sends an email when forecasted spend exceeds a threshold?

AWS Budgets.

Q3. Which is stronger: password only, or password + authenticator code?

Password + authenticator (MFA).

Q4. You accidentally commit an access key to a public GitHub repo. First action?

Deactivate/delete the key in IAM immediately, then rotate and review CloudTrail for misuse. Removing the commit is not enough; assume it's compromised.

6. Checklist

AWS account created
Root MFA on, no root access keys
Admin IAM user with MFA
Zero-spend + monthly budget created
Screenshots saved in evidence/