How this course works

Neither of these needs bad luck. Both come from how the account was set up. This lesson sets yours up so neither can happen quietly, and explains how the rest of the course works.

Two ideas: how each lesson is built, and how to practise on a real AWS account without risk.

Every lesson has the same six parts

The order never changes, so you always know where you are. The tracker on the right of wide screens shows which part you’re reading.

Practising on a real account is safe if you set it up properly

The labs run on your own AWS account. That’s the only way to really learn it. It’s also where the two dangers are:

The root user is the email address you signed up with. It can do anything, including close the account, and no rule can limit it. So you lock it away and create a separate admin login for yourself.

What the cost badges mean

Rough prices in this course are for us-east-1, rounded, and AWS changes them over time. Treat them as “about this much”, not as a quote.

The free tier, honestly

AWS’s free offers changed in 2025, and which ones you get depends on when your account was created.

Check what applies to you in Billing and Cost Management → Free Tier. Don’t rely on “it’s probably free”. Some things this course uses, like NAT gateways and Kubernetes clusters, aren’t covered by the older free tier at all. If a lab needs something your plan doesn’t allow, the console tells you when you try.

The rules for every lab

Start some of the things that charge by the hour, then let the days pass. Watch the bill, and the $10 budget. Then clean up and let more days pass.

What to notice: nothing in this picture is doing any work. There are no users. The bill grows anyway, because you pay for things existing, not for them being used. And the budget emails arrive while everything keeps running. The only thing that stops the number is Clean up everything.

Free — creating an account, MFA, IAM Identity Center and a budget cost nothing.

You’ll create an AWS account and set it up safely: MFA on the root user, a budget alert, and a separate admin login through IAM Identity Center. About 30 minutes. If you already have an account, skip the first step and check the rest are done.

You need an email address that nobody else can read, a phone, and a payment card. AWS asks for a card even if you only use free things.

1. Create the account

   Search the web for AWS create account, and open the sign-up page on AWS’s own site. The screens change from time to time, but they ask for these things:

   Screen	Enter
   Root user email address	An email only you can read. This email is the root user
   AWS account name	quickcart-learning
   Verify email address	The code AWS emails you
   Root user password	A long, unique password from a password manager
   Account plan	Free plan or Paid plan, if you’re asked. See the free tier table in the idea. If you’re unsure, the free plan is the safer choice; you can upgrade later
   Contact information	Your details. Choose Personal
   Billing information	Your card
   Confirm your identity	Your phone number, then the code AWS sends
   Support plan	Basic support – Free

   You should see

   A page saying your account is being activated. It can take a few minutes, sometimes longer, before every service works.

2. Turn on MFA for the root user

   Sign in to the console as the root user: choose Root user on the sign-in page and use your email and password. AWS now requires MFA for the root user, so it may ask you to set it up straight away. If it doesn’t, do it now.

   AWSIn the AWS console: Account menu (top right)→Security credentials→Assign MFA device

   Field	Enter
   Device name	root-phone
   MFA device	Passkey or security key if you have one, otherwise Authenticator app

   Choose Next. For an authenticator app, choose Show QR code, scan it with the app, then type two codes in a row from the app into MFA code 1 and MFA code 2. Choose Add MFA.

   You should see

   Back on Security credentials, the Multi-factor authentication (MFA) section lists root-phone. Further down, the Access keys section says there are none. Keep it that way: never create access keys for root.

3. Create a budget alert

   You’re signed in as root, which can always see billing, so create the budget now. Pick your monthly limit from the roadmap lab. This course uses $10.

   AWSIn the AWS console: Billing and Cost Management→Budgets→Create budget

   Field	Enter
   Budget setup	Use a template (simplified)
   Templates	Monthly cost budget
   Budget name	quickcart-monthly
   Enter your budgeted amount ($)	10
   Email recipients	Your email address

   Choose Create budget.

   You should see

   quickcart-monthly in the list of budgets, with a budgeted amount of $10.00. The template emails you when your actual spend passes 85% and 100% of the amount, and when AWS forecasts you’ll pass 100%. The exact thresholds may differ if AWS changes the template.

4. Turn on IAM Identity Center

   IAM Identity Center is where you’ll create your everyday admin login. Check the region selector at the top right says N. Virginia (us-east-1) first: Identity Center lives in one region, and that’s where you’ll find it later.

   AWSIn the AWS console: IAM Identity Center→Enable

   If it asks how to enable it, choose to enable it with AWS Organizations. That makes your account the only member of a new organization. It’s free, and it’s what lets Identity Center give you access to the account.

   You should see

   The IAM Identity Center dashboard. Under Settings summary, note the AWS access portal URL: a web address ending in awsapps.com/start. Bookmark it. It’s where you’ll sign in from now on.

5. Create your user

   AWSIn the AWS console: IAM Identity Center→Users→Add user

   Field	Enter
   Username	Your first name in lowercase, like maya
   Password	Send an email to this user with password setup instructions
   Email address	Your email address
   Confirm email address	The same again
   First name	Your first name
   Last name	Your last name

   Choose Next, skip Add user to groups with Next, then choose Add user.

   You should see

   Your user in the list, with a note that an invitation email was sent.

6. Create an admin permission set

   A permission set is a named bundle of permissions that Identity Center can give to people in an account.

   AWSIn the AWS console: IAM Identity Center→Permission sets→Create permission set

   Field	Enter
   Permission set type	Predefined permission set
   Policy for predefined permission set	AdministratorAccess

   Choose Next.

   Field	Enter
   Permission set name	AdministratorAccess, the default
   Session duration	1 hour, the default. Choose up to 12 hours if you’d rather sign in less often

   Choose Next, then Create.

7. Give your user admin access to the account

   AWSIn the AWS console: IAM Identity Center→AWS accounts

   Tick your account, then choose Assign users or groups. On the Users tab, tick your user and choose Next. Tick AdministratorAccess, choose Next, then Submit.

   You should see

   A message saying the assignment succeeded. Under your account, your user is listed with AdministratorAccess.

8. Sign in as your admin user

   Open the email with the subject Invitation to join AWS IAM Identity Center and choose Accept invitation. Set a password, then register an MFA device when asked. It’s a separate login from root, so give it its own entry in your authenticator app.

   You land on the AWS access portal. Open your account and choose AdministratorAccess.

   You should see

   The AWS console. The account menu at the top right shows AdministratorAccess/maya, with your own name in place of maya. This is how you’ll sign in from now on.

9. Clean-up step: Clean up

   Nothing here costs money, so there’s nothing to delete. Keep all of it: the MFA, the budget and your admin user are what keep the rest of the course safe.

   Sign out of root, and put the root password and MFA somewhere safe. From now on, sign in only through your access portal bookmark.