mrvitej.in

Archive · AWS

First Steps in a New AWS Account

Protect the root user, create an admin IAM user and set a billing alarm before launching anything.

1 min read

  • AWS IAM
  • AWS Billing
  • Region ap-south-1 Mumbai

Do these before any other work in a new account.

  1. Secure the root user. Enable MFA on it, then stop using it day to day.
  2. Create an IAM user (or group) for administration with its own MFA, and sign in with that.
  3. Set a billing alarm. In the Billing console enable Receive Billing Alerts, then create a CloudWatch alarm on EstimatedCharges. Billing metrics live only in the us-east-1 region, whichever region you work in.
  4. Choose a region. For users in India, Asia Pacific (Mumbai) ap-south-1 gives the lowest latency.
flowchart LR
  R[Root user with MFA] --> I[IAM admin user with MFA]
  I --> S[Day to day work]
  R -. emergencies only .-> X[Billing and account settings]

Never create access keys for the root user. Give each person their own IAM user, and grant least privilege rather than AdministratorAccess to everyone.