Securing your account in the first hour

A new AWS account starts with one identity: the root user, signed in with the email address you registered. The root user can do anything, including closing the account. Protect it first.

1. Enable MFA on the root user

In the console, open the account menu, choose Security credentials and add a multi factor authentication device. A passkey or security key is the strongest option; an authenticator app is fine. Store recovery details somewhere safe.

2. Never create access keys for root

Access keys are a long term key id and secret used by the CLI and SDKs. For the root user they should simply not exist. If you find one, delete it.

3. Create an identity for daily work

AWS recommends IAM Identity Center for people who sign in to AWS, because it issues short lived credentials. For a single personal account, a simpler option is an IAM user in an admins group with MFA enabled. Either way, after this step you sign in as that identity and keep the root user for the rare tasks that require it.

4. Set a budget with an alert

Open Billing and Cost Management, choose Budgets and create a monthly cost budget with an alert by email. Pick an amount small enough to notice, such as a few dollars, and add an alert at 80 percent of it.

5. Install and configure the CLI

# macOS example; installers for all platforms are in the AWS docs
curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o AWSCLIV2.pkg
sudo installer -pkg AWSCLIV2.pkg -target /

# With IAM Identity Center
aws configure sso

# Check who you are
aws sts get-caller-identity

get-caller-identity is the first command to run whenever you are unsure which account or identity the CLI is using.

6. Keep secrets out of code

If you do create access keys for an IAM user, never paste them into source code or commit them to Git. Automated scanners find leaked keys on public repositories within minutes. Prefer short lived credentials from Identity Center, and roles for anything running inside AWS, which we cover in the next section.

These steps take about an hour and prevent the majority of painful first month stories.