AWS Builder Center

Builder Center

Day one on AWS: what I locked down before running anything

Day one on AWS: what I locked down before running anything

I had to upgrade to the Paid Plan to activate Student Rewards, so before running anything I set up a zero spend budget, root MFA and a few cost checks. Here’s the 15-minute checklist, plus the idle resources that bill you even when nothing uses them.

I got access to AWS through Student Rewards on Builder Center. The first reward is a year of Skill Builder, and activating it turned out to be the first real decision I had to make about my account.

The upgrade I didn’t plan for

The Skill Builder checkout page says Free Plan accounts can’t complete payment, even when the code brings the total to $0. So I upgraded to the Paid Plan.
That changes one important thing. On the Free Plan, the account simply stops when your credits or free period run out. On the Paid Plan, AWS keeps billing until you delete the resources yourself. Nothing is charged for an empty account, but a mistake is no longer capped.
So before touching a single service, I spent about fifteen minutes on the steps below.

1. Check what credits you have

Billing and Cost Management -> Credits. My new account had two:
  • $100 AWS Free Tier credit
  • $20 for “Set up a cost budget using AWS Budgets”, which I earned in step 2
Both are valid for a year. Small mistakes get paid from credits first, so this is your buffer, not your budget.

2. Create a zero spend budget

Budgets -> Create budget -> Use a template -> Zero spend budget.
It sends an email as soon as actual spend goes above $0.01. Two details I almost missed:
  • New recipients have to verify their email address before alerts arrive. Check the status on the budget page.
  • I used my university email first, then added a personal address too. Student mailboxes can disappear after enrollment ends, and an alert that goes nowhere is worse than none.

3. Turn on MFA for the root user

Account menu (top right) -> Security credentials -> Assign MFA device. Any authenticator app works.
A forgotten instance is the classic student horror story. A leaked root password used for crypto mining is the expensive one.

4. Confirm nothing is running

  • EC2 -> EC2 Global View shows instances, volumes and other resources across all regions at once. On a new account it should be empty.
  • Billing -> Bills should show $0. On a fresh account, cost data can take up to 24 hours to appear, so “Data unavailable” on day one is normal.

5. Know the resources that cost money while idle

A budget alert tells you about spending. It doesn’t stop it. These are the ones that keep charging even when nothing uses them:
Resource
Why it surprises people
NAT Gateway
Around $30 a month in us-east-1 before any traffic
Public IPv4 addresses
Billed hourly since 2024, including Elastic IPs
EBS volumes and snapshots
Survive after you terminate the instance
Route 53 hosted zones and KMS keys add small monthly charges too.

Finding these across services and regions is harder than it should be, so I also asked for  one view of idle resources that still cost money .

6. Practice in the sandbox when you can

Most Skill Builder labs run in temporary accounts that AWS creates and deletes for you. Mistakes there don’t touch your own bill. I keep my own account for small experiments and delete everything after each one.

What I wish existed

There's no hard spending cap for Paid Plan accounts, only alerts. I posted this as a wish on Builder Center:  a hard spending cap for Paid Plan accounts . If you'd use it too, a vote helps.
# beginner-projects
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article