Lesson 1: Your AWS Account: Free Plan, Paid Plan and Credits

Before you click "Create account"

You already know what the cloud is. In this course you build something on it. Over 20 lessons you'll take one small web app from an empty AWS account to a production setup with a database, file uploads, secrets, monitoring, a custom domain, CI/CD and infrastructure as code. At the end, you delete all of it.

This course is independent and is not made, sponsored or endorsed by Amazon Web Services. AWS changes its services, prices and free-tier rules often, so check anything that costs money on AWS's own pages before you rely on it.

This lesson creates nothing that costs money. We open the account carefully, pick a plan and lock the front door.

The app you'll build

The app is a small link board. Users post a title and a URL, can attach an image, and see the latest posts. The course supplies the code in Python. Here is the very first version, which needs no AWS at all:

# app.py: version 0, runs on your laptop only
from flask import Flask, jsonify

app = Flask(__name__)
LINKS = [{"title": "AWS docs", "url": "https://docs.aws.amazon.com"}]  # in memory for now; a real database comes later

@app.get("/health")          # every deployment we make will be checked against this endpoint
def health():
    return {"status": "ok"}

@app.get("/links")
def links():
    return jsonify(LINKS)

pip install flask
flask --app app run          # then open http://127.0.0.1:5000/health
# {"status": "ok"}

Every lesson after this one has the same three parts:

1. Build one working piece.
2. Check that it works, with a command or URL and the output you should see.
3. Clean up, with the exact command that removes whatever costs money.

Habit 3 is the one that saves you money. Most surprise cloud bills come from things people forgot were still running, not from what they deployed on purpose.

Free plan or Paid plan?

When you sign up, AWS asks you to choose between two account plans. Both give new customers the same credits:

• USD $100 in credits when the account is created.
• Up to USD $100 more for completing short activities in the console. AWS has listed five, worth $20 each, such as setting up a budget or launching and then terminating an EC2 instance.
• Access to services that have always-free monthly allowances.

The plans differ in what happens when money runs out:

Think of the Free plan as a prepaid card with a hard stop: it can't overspend, but when it's empty the shop shuts. The Paid plan is a debit card with a voucher attached. The voucher is used first, then your card pays.

Gotcha: Some actions upgrade a Free plan account to Paid automatically. One is joining AWS Organizations; AWS's terms list the others. Read the screen before you click anything with "organization" in it.

Trade-off: On the Free plan you can't get a surprise bill, but it only covers selected services, and if you forget the 6-month deadline your work disappears after the 90 days. The Paid plan has no deadline, but a resource you forget about keeps costing money once the credits are gone. That is why the next lesson is about budgets and alerts.

Recommendation for this course: start on the Free plan. If a later lesson needs something the Free plan doesn't include, upgrade from Billing and Cost Management → Upgrade plan. Any credits you have left carry over to the Paid plan.

Signing up the safe way

Sign-up checklist
[ ] Use an email address you'll control for years, e.g. aws-root@yourdomain.com
    (a shared or forwarding mailbox, NOT a work address you might lose when you change jobs)
[ ] Use a long, unique password kept in a password manager
[ ] Use a phone number you actually keep: it's your recovery path if you lose your MFA device
[ ] Choose a plan (Free is fine to start)
[ ] Give a valid payment card: AWS verifies it even on the Free plan

The email and password you sign up with are the credentials of the root user. Root is the one identity that has unrestricted access to everything in the account.

Locking down the root user

AWS requires every root user to have multi-factor authentication (MFA). If you don't set it up at sign-up, you have to register a device within 35 days of your first sign-in attempt. Do it today:

Console → account name (top right) → Security credentials
  → Multi-factor authentication (MFA) → Assign MFA device

Options, best first:
  1. Passkey or security key (e.g. YubiKey, or a passkey in 1Password/iCloud/Google)
     → resistant to phishing; this is what AWS recommends
  2. Authenticator app (TOTP codes)
  3. Hardware TOTP token

You can register up to 8 MFA devices, so register two: for example a security key and a passkey saved in your password manager. Then losing one device doesn't lock you out.

Check that it worked: sign out, sign back in as root, and confirm you're asked for MFA. On the Security credentials page you should see something like this:

Multi-factor authentication (MFA) (2)
  Type              Identifier            Created on
  Passkey           root-yubikey          2026-10-17
  Passkey           root-1password        2026-10-17
Access keys (0)     <- keep this at zero

How to treat root from now on:

• Never create access keys for root. A leaked root key gives someone the whole account.
• Don't use root for daily work. Lesson 3 sets up an everyday admin identity for that.
• Keep root for the jobs only it can do: changing the account email or root password, closing the account, restoring access if the only administrator accidentally removes their own permissions, and a few billing tasks.

Root is like the master key to a building. It goes in a safe, and you don't carry it to make coffee.

Clean up: nothing to remove. This lesson created no billable resources.

Key takeaways

• New customers on either plan get $100 in credits at sign-up and can earn up to $100 more by completing activities.
• The Free plan never charges you. It ends after 6 months or when the credits are used up, whichever comes first. The account then closes, and you have 90 days to upgrade before it's deleted.
• The Paid plan gives access to every service and uses your credits first, then charges standard prices. Its credits expire 12 months after the account is created.
• Root MFA is mandatory. Use a passkey or security key, register two devices and never create root access keys.
• Every lesson ends with a check and a clean-up command.