Lab: harden the account

Set up your AWS account the way a professional would on day one at a new company. Do these in order — the order is part of the lesson.

1. Root hygiene (20 min)

1. Create your AWS account (or audit an existing one against this list).
2. Sign in as root → Security credentials → enable MFA (authenticator app: scan, confirm two codes).
3. Verify root has zero access keys (delete any that exist).
4. Set a strong, unique root password stored in a password manager.

2. Create your admin identity (25 min)

1. IAM → Users → create yourname-admin: console access, strong password, MFA enabled on this user too.
2. Attach the AWS-managed AdministratorAccess policy (Week 2 will make you feel appropriately guilty about how broad this is — for a solo learning account with MFA, it's acceptable; for the fictional company in next week's project, it won't be).
3. Sign out of root. Sign in as your admin user. Root goes in the drawer — you'll touch it again maybe twice this course.

3. CLI setup (25 min)

1. Install the AWS CLI v2 for your OS; verify with aws --version.
2. Create an access key for your admin user (note: Week 2 teaches why long-lived keys are a smell and how roles fix it — this one is a bootstrap).
3. aws configure — key, secret, your chosen Region, json output.
4. First commands — read what comes back, don't just run them:

aws sts get-caller-identity          # who am I? (account id, user ARN)
aws ec2 describe-regions --output table
aws iam list-users

4. Teardown check (the first of many)

Nothing to tear down this week — but write the checklist anyway: created: 1 IAM user, 1 access key. Deleted: root access keys (if any). Remaining intentionally: admin user, MFA devices. The habit is the deliverable.

Deliverable

Screenshots: root MFA enabled, admin user with MFA, get-caller-identity output (blur the account id if posting publicly — that habit matters too). Reviewer checks: no root keys, MFA everywhere, CLI working as the admin user (not root).