AWS account workflow

A repeatable workflow keeps sandbox learning safe: create account → secure root → create IAM admin → enable billing alerts → use named profiles → tag resources → tear down experiments.

Account setup checklist

1. Create AWS account with strong root password
2. Enable MFA on root (hardware or authenticator app)
3. Create IAM user or SSO identity for daily Console/CLI work
4. Enable AWS Budgets or billing alarms
5. Never commit access keys to Git—use environment variables or a secrets manager

Free tier / sandbox safety: Stay within free-tier limits, set billing alerts, and tear down resources you create for learning. Never paste real access keys, secret keys, or passwords into lessons, tickets, or chat.

Named CLI profiles

aws configure --profile sandbox
export AWS_PROFILE=sandbox
aws sts get-caller-identity

Separate sandbox from work profiles to avoid accidental changes in the wrong account.

Resource tagging habit

# When launching resources, tag for cost tracking:
# Key: Environment  Value: learning
# Key: Owner         Value: your-name
# Console: EC2 → Tags tab, or use --tag-specifications on create

Teardown discipline

• Stop or terminate EC2 instances you no longer need
• Release unassociated Elastic IP addresses
• Delete empty S3 buckets (must be empty first)
• Remove NAT gateways and unused load balancers

Forward to Cybersecurity for identity hygiene and incident response basics.

Important interview questions and answers

1. Q: Why avoid root for daily tasks?
   A: Root has unrestricted access—compromised root keys are catastrophic; use IAM with least privilege.
2. Q: What is AWS_PROFILE?
   A: Selects which named credential profile the CLI uses for a command session.

Self-check

1. List three steps in a safe new-account workflow.
2. Why tag resources with Environment=learning?