mrvitej.in
Happy Dussehra! May good always win. Happy Diwali! Wishing you a bright year ahead. Merry Christmas! Warm wishes from Vizag. Happy New Year! Here’s to a great year ahead.

Archive · AWS

First Steps in a New AWS Account

Secure the root user, create an admin identity, set a password policy, turn on billing alerts and budgets, and choose a region before you launch anything.

4 min read

  • AWS IAM
  • AWS Billing
  • AWS Budgets
  • Region ap-south-1 Mumbai

The first hour in a new AWS account decides whether it stays secure and affordable. Do these steps before creating any servers: protect the all-powerful root user, work through a named admin identity, and set up cost alerts so a mistake shows up in hours, not at month end.

State of AWS on this date. The Mumbai region (ap-south-1) has been available since 2016 and is the natural choice for users in India. The AWS Free Tier gives 12 months of limited usage (for example 750 hours of a t2.micro per month) plus always-free services.

The setup order

flowchart TB
  A[Create account<br/>email, card, phone verification] --> R[Root user - strong unique password]
  R --> M[Enable MFA on root<br/>virtual authenticator or hardware key]
  M --> LK[Lock root away<br/>no access keys, use rarely]
  LK --> AD[Create IAM admin user or group<br/>or IAM Identity Center]
  AD --> MF2[MFA for the admin too]
  MF2 --> PP[Account password policy]
  PP --> BL[Billing alerts and AWS Budgets]
  BL --> CT[Enable CloudTrail<br/>log all API activity]
  CT --> RG[Choose region ap-south-1]
  RG --> WK[Daily work as admin user<br/>least privilege roles later]

1. Secure the root user

The root user (the email you signed up with) cannot be restricted by IAM policies. Treat it like a master key.

  1. Sign in as root, open My Security Credentials, and activate MFA (an authenticator app or a hardware key).
  2. Make sure there are no root access keys; delete any that exist.
  3. Use a strong, unique password in a password manager, and a shared mailbox the team controls (not one person’s inbox) as the root email.
  4. Keep the phone number and recovery contacts current, and set alternate contacts for billing, operations and security.
  5. After the next steps, stop using root for daily work. You still need it for a few tasks, such as closing the account or changing the support plan.

2. Create an administrator

Create an IAM group Admins with the AdministratorAccess managed policy, add a user to it with console access and MFA, and sign in via the account-specific URL:

aws iam create-group --group-name Admins
aws iam attach-group-policy --group-name Admins --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
aws iam create-user --user-name ravi
aws iam add-user-to-group --group-name Admins --user-name ravi
aws iam create-login-profile --user-name ravi --password-reset-required --password '<temporary>'
aws iam update-account-password-policy --minimum-password-length 14 \
   --require-symbols --require-numbers --require-uppercase-characters --require-lowercase-characters \
   --max-password-age 90 --password-reuse-prevention 5

For several people, give each their own user (or use AWS Single Sign-On with AWS Organizations) and attach permissions to groups or roles, never directly to people. Create access keys only when a program needs them, rotate them, and prefer IAM roles for workloads running on AWS.

3. Cost visibility and limits

  1. In Billing preferences, enable Receive Billing Alerts and PDF invoice by email, and allow IAM users to view billing if needed.
  2. Create an AWS Budget (monthly, cost-based) with alerts at 50%, 80% and 100% of your limit, sent to a team mailbox.
  3. Enable Cost Explorer (it takes up to 24 hours to populate) and tag resources (owner, project, env) from day one; activate those as cost allocation tags.
  4. Watch the Free Tier usage page, because it warns before you leave the free allowance.
aws budgets describe-budgets --account-id 123456789012

Budgets alert, they do not stop spending. Set a conservative number, and add a CloudWatch billing alarm (metrics in us-east-1) as a second signal.

4. Turn on logging

Enable CloudTrail with a trail that records all regions into a dedicated, private S3 bucket. The last 90 days of management events are visible in the console by default, but a trail keeps them permanently and lets you search after an incident.

5. Regions and quotas

Pick one primary region, ap-south-1, and do not scatter resources: it makes cost and security reviews harder. Some services and global features (IAM, Route 53, CloudFront, billing metrics) live in us-east-1 or are global. Every account has service quotas per region (for example the number of vCPUs of On-Demand instances); new accounts start low, and you can request increases.

Checklist before you build

  • Root MFA on, no root access keys
  • Admin user or group with MFA
  • Password policy set
  • Budget and billing alerts reach a monitored mailbox
  • CloudTrail enabled
  • Region chosen and tagging scheme agreed

Common beginner mistakes

Leaving an unused EC2 instance or NAT gateway running, publishing access keys to a public Git repository (bots find them within minutes), opening SSH to 0.0.0.0/0, and granting AdministratorAccess to every user. Fixing these costs minutes now, and days later.