The AWS Beginner’s Rule book: 12 Rules to Avoid Costly Mistakes

I already posted a road map for beginners, so this one is different. The road map tells you what to learn. This tells you what to do (and not do) once you actually start clicking around in AWS. Most of the horror stories you hear, like surprise bills, leaked data, or deleted work, come from breaking one of these rules.

Rule 1: Don’t use the root account for daily work
The root user can do literally everything, even close the account. Turn on MFA for it, keep the login safe, and use an IAM user (or IAM Identity Center) for your normal stuff.

Rule 2: Give only the permissions that are needed
Every user or role should get just enough access to do its job. Giving AdministratorAccess to everything is easy, but then one small mistake becomes a big one.

Rule 3: Never put access keys in your code
If you push keys to GitHub, bots find them in minutes. Use IAM roles for EC2 and Lambda, and keep any local credentials out of your repos.

Rule 4: Don’t open SSH or RDP to the whole internet
If a security group allows port 22 (Linux) or 3389 (Windows) from 0.0.0.0/0, you’ll get attack attempts all the time. Allow only your own IP, or use Systems Manager Session Manager.

Rule 5: Keep S3 buckets private
Leave Block Public Access turned on. Only make something public if you can clearly explain why.

Rule 6: Set a budget alert on day one
Make a budget in AWS Budgets with email alerts before you launch anything. Also check the current Free Tier terms, because they change and can be different for newer accounts.

Rule 7: “Stopped” doesn’t mean “free”
A stopped EC2 instance doesn’t charge for compute, but its EBS volume still costs money. If you don’t need it anymore, terminate it.

Rule 8: Hunt the leftovers
These keep billing even after the main resource is gone:

Rule 9: Check the Region before you click
Resources live in one Region, and the console remembers the last one you used. A lot of beginners “lose” servers that are still running in a Region they forgot about. Look at the Region selector before every launch and every cleanup.

Rule 10: Tag everything
Add tags like Project, Owner, and Delete-After when you create things. When the bill comes or it’s cleanup time, you’ll know what each resource was for.

Rule 11: Don’t experiment on anything that matters
Use a separate account or a clearly labelled sandbox for learning. Take a snapshot or backup before changing something you care about.

Rule 12: Clean up when you’re done
End every practice session with a check: instances terminated, volumes deleted, buckets emptied. Make it a habit, like closing the tabs you opened.

☐ No instances running that I don’t need

☐ No orphaned volumes, snapshots, or Elastic IPs

☐ No NAT Gateways or load balancers left on

☐ I checked every Region I used

☐ Budget alerts are active

You don’t need to memorise the whole platform to use AWS safely. Follow these twelve rules and you’ll avoid most of the mistakes that cost beginners money and sleep.