Sign Up

# ===== 1. Account creation =====
# https://aws.amazon.com/ -> Create a free account
# - Email + password (this becomes the ROOT user)
# - Credit card (required even for free tier)
# - Phone verification
# - Pick a support plan (Basic = free)

# Free tier highlights (verify on aws.amazon.com/free):
# - 12 months: 750 hours/mo of t2.micro EC2, 5GB S3, 1M Lambda req/mo
# - Always free: some DynamoDB, SNS, etc

# ===== 2. Lock down the root account =====
# Treat root like nuclear codes:
# - Long, unique password
# - Hardware MFA (YubiKey) or virtual MFA (Authy / 1Password)
# - Set up account recovery contacts
# - Disable root API keys (never create them)

# After this, you should rarely (if ever) log in as root again.

# ===== 3. Create your first IAM admin user =====
# Console -> IAM -> Users -> Add user
# Name: admin (or yourname)
# Access: AWS Management Console + (optionally) Programmatic
# Permissions: AdministratorAccess policy (you'll narrow later)
# Enable MFA

# Or better: IAM Identity Center (formerly SSO) for human access.

# Sign out as root; sign back in via the IAM user URL:
# https://<account-id>.signin.aws.amazon.com/console

# ===== 4. Billing alerts =====
# Console -> Billing -> Billing preferences
#   Enable: Receive Free Tier Usage Alerts
#           Receive Billing Alerts
# Console -> CloudWatch -> Alarms -> Billing
#   Create alarm: estimated charges > USD 10 / 50 / 100 -> SNS -> your email

# Or via Cost Management -> Budgets: monthly cap with multi-threshold alerts.

# ===== 5. Cost Anomaly Detection (free) =====
# Cost Management -> Cost Anomaly Detection -> Create monitor
# Catches shape changes (a stuck Lambda costing 100x normal) within ~24h.

# ===== 6. Region =====
# Pick a region close to users (e.g. ap-southeast-2 for AU users)
# Most services charge per region; switching later is real work.

# ===== 7. Tag policy from day one =====
# Tag every resource with: project, env, owner
# Tag policies in AWS Organizations enforce shapes across accounts.

# ===== 8. CLI =====
brew install awscli                       # or pip install awscli / installer
aws configure                              # interactive: access key + region
aws sts get-caller-identity               # verify

# Prefer aws-vault or AWS SSO for credentials in 2026:
brew install aws-vault
aws-vault add admin
aws-vault exec admin -- aws s3 ls

# ===== 9. Common day-one services =====
# - S3 (bucket with Block Public Access ON by default!)
# - CloudWatch (log groups + alarms)
# - IAM (roles / users)
# - VPC default (you have one; you can keep it for dev)
# - Cost + Usage Report (turn it on; pay nothing for the report, pay for the storage)

# ===== Patterns to internalise =====
# - Root: lock + MFA + never log in for daily work
# - IAM Identity Center for humans; IAM roles for workloads
# - Tag everything; build a CUR + Athena report early
# - Multiple budget alarms (50/80/100%) per account

# ===== Pitfalls =====
# - Root account in daily use
# - Generating root access keys (huge red flag)
# - No MFA on the IAM admin
# - No billing alarms; surprise USD 4-figure bills

# Sign up at aws.amazon.com — needs a card.
# Activate budgets + alerts before doing anything else.