The root account: power you must lock away
When you create an AWS account, you get the root user — the email/password identity that can do literally anything, including close the account and change payment details. Professional rule, non-negotiable:
- Enable MFA on root immediately (an authenticator app is fine).
- Create an IAM admin user for daily work (Week 2 explains IAM deeply; today you just do it).
- Log out of root and don't return except for the few tasks that require it (billing setup, account closure). Root credentials are a break-glass tool, not a login.
No access keys on root, ever. This is the first thing security auditors check and the first question in every cloud interview about account hygiene.
Billing BEFORE building
The most common beginner disaster isn't a hack — it's a surprise bill: a forgotten NAT Gateway, an instance in a Region you don't check, a "free tier" resource past its limits. So before this course launches a single server:
- AWS Budgets: create a $5 budget (early warning) and a $20 budget (something is wrong) — each emailing you at 50/80/100% of forecast.
- Cost Explorer: enable it now (it needs ~24h to populate). Your weekly homework all course: open it, look at the trend, explain every line. An unexplainable $0.40 is a teachable mystery.
- Free Tier awareness: 12-month allowances (750 hrs/month of t2/t3.micro EC2, 5GB S3, 750 hrs RDS…) plus always-free services (Lambda's first million requests). The traps: Free Tier is per account per month (two instances = 375 hrs each), NAT Gateways and Elastic IPs are never free, and leaving things running is the whole game. Hence—
Teardown discipline (graded, all twelve weeks)
Every lab in this course ends with a teardown checklist: what you created, what you deleted, what intentionally remains. "I'll delete it later" is how bills happen. The reflex you're building: infrastructure is cattle, not pets — create it fast, destroy it without sentiment. Week 11 turns this philosophy into one-command terraform destroy; until then, you are the destroy command.
Console + CLI
The console (web UI) is where you'll learn; the CLI (aws command) is where professionals live — scriptable, repeatable, precise. Install it this week (aws configure with your admin user's credentials — temporary keys done properly arrive in Week 2). From Week 3, every console action gets a CLI rep. Automation instincts start early or never.