🔑 Creating an AWS Account: Root User, Plans and the First Hour

What an AWS account is, the free plan and the paid plan as they work now, the root user and why you almost never sign in as it, a budget alert, and how to close the account when you are done

What an AWS account is

An AWS account is a container for resources and for the bill. It is also the main security boundary: by default nobody outside the account can touch what is inside it. Three words to keep apart:

• The account is identified by a 12-digit account ID and created with an email address.
• The root user is the identity that exists the moment the account is created: the email and password you signed up with. It has complete access to everything, including billing and closing the account.
• IAM identities (users and roles, made inside the account with the service called IAM) are what you actually use day to day.

If you read the Azure account page, the mapping is: an AWS account is close to an Azure subscription (it holds the resources and gets the bill), but AWS has no separate "tenant": the account itself is the directory of its IAM users. Companies that use many accounts group them with AWS Organizations, and sign people in with IAM Identity Center (more below).

Ways to start

From AWS's documentation (read on 6 October 2026), a new customer chooses a plan when signing up:

• Free account plan. You receive $100 in credits after creating the account, and you can earn up to $100 more by completing activities (so up to $200). "You will not incur any charges during this period until you upgrade to a paid account plan." The plan ends after six months, or when the credits are used up, whichever comes first. Then the account closes automatically and you lose access to your resources; AWS keeps your content for 90 days, and you can upgrade to a paid plan within those 90 days to keep it (any remaining credits then apply to future bills). The free plan only has select services: it leaves out things that could burn the credits quickly, such as Savings Plans, Reserved Instances and some Marketplace offers.
• Paid account plan. You also get the $100 sign-up credit, but everything is open and you pay standard prices for anything above the credits. This is the normal account for real work, and also where surprise bills come from.
• Always-free services. Over 30 services have a monthly free allowance, on both plans, with no time limit.

Details worth knowing:

• The free plan automatically becomes a paid plan if you do certain things: join AWS Organizations, set up Control Tower, join the AWS Partner Network and a few more (AWS's terms list them). Joining an organization is the one people hit by accident.
• Free-plan accounts are not eligible for other promotional credits.
• Older accounts (opened before the 2025 change) keep their own rules, historically a 12-month free tier. The free AWS VM guide describes both. Look at your own Free Tier page in the Billing console to see which applies to you.
• A credit card and phone verification are part of signing up.

Signing up (from the documentation)

The usual order, from the outline in AWS's documentation (the screens change, so follow the screens):

1. Go to aws.amazon.com/free and choose Create free account.
2. Enter an email address (this becomes the root user) and an account name, then verify the email with the code AWS sends.
3. Set a strong password for the root user.
4. Enter your contact details and add a credit or debit card.
5. Verify your phone number.
6. Choose a support plan. Basic is free, and the paid plans (Developer, Business and above) are extras you do not need to learn.
7. Choose the account plan: free or paid.

If you are making a company account, use a group email address that forwards to several people (not one person's mailbox): AWS says that if it has to contact the owner, this avoids delays when someone is away or has left, and the address should not be used for anything else.

The first hour: the root user

AWS's own advice is blunt: do not use the root user for everyday work. From the "root user best practices" page:

• Turn on MFA for the root user at once. AWS requires it for every account type. If MFA is not set up, the console asks you to register one within 35 days of your first sign-in attempt. You can register up to eight MFA devices (a FIDO security key, a hardware token, or an authenticator app), and AWS recommends more than one.
• A strong, unique password (8 to 128 characters, at least three of the four kinds of characters, and not the same as the account name or email). A password manager does this best.
• Do not create access keys for the root user. Keys let programs and the CLI act as that user, and the root user can do anything, including with billing.
• Keep the recovery path alive. If you lose all your MFA devices, recovery needs the registered email and phone number, so keep both current. In a company, nobody should have both.
• Use root only for the few tasks that need it (AWS keeps a list: changing the account settings, closing the account and similar).

Then make an everyday user

Create an administrative identity for daily work, and let the root user rest. AWS's advice:

• One account, one person: create an IAM identity (AWS prefers roles that give temporary credentials; an IAM user with MFA is the simple route), and give it the permissions it needs. Starting with an AWS managed policy and narrowing later is the documented way.
• Many accounts or many people: use IAM Identity Center: one place to sign people in and decide what they can do in each account. AWS recommends it for centralized access.
• Everyone has their own identity. Shared logins hide who did what.
• Prefer temporary credentials over long-lived access keys, and review regularly what is unused and remove it.

A budget alert

AWS Budgets (in the Billing and Cost Management console) watches your costs and warns you. From the documentation:

• You can set a monthly cost budget with a fixed amount, and be alerted on actual spending and on forecasted spending, by email, by an Amazon SNS topic, or both.
• Budget information is updated up to three times a day, about every 8 to 12 hours. AWS notes there can be a delay between a charge and the notification, so you can pass the threshold before the alert arrives.
• A budget only warns by default. Budget actions can do more, for example apply an IAM policy that denies creating more resources when a threshold is reached, but you have to set that up on purpose.
• On the free plan, the Billing console home also shows your credit balance and the plan end date. Look at it weekly, and keep the Free Tier usage alerts on (Billing preferences: "Receive Free Tier Usage Alerts"), as the free VM guide says.

The CLI

Everything in the console is also available from the AWS CLI (aws) and from CloudShell, a terminal in the console with the CLI ready. The first commands, none of which change anything (from the documentation, not run here):

aws sts get-caller-identity
aws configure list
aws configure get region
aws ec2 describe-regions --output table

• aws sts get-caller-identity answers "who am I?": it prints the account ID and the identity (the ARN). Run it before anything else, so a test does not land in the wrong account.
• aws configure list shows where the CLI gets its credentials and its default region.
• Sign in without storing a permanent key: aws configure sso (for IAM Identity Center) or aws login, which AWS's documentation describes as giving temporary, automatically rotated credentials. Try to avoid aws configure with a pasted access key: that is a long-lived secret in a file.
• Each command uses a region (see the regions page): the default one, or --region eu-west-1 on the command.

Closing the account

From AWS's account closure page:

1. Only the root user can close the account. Sign in as root.
2. Back up what you want, then delete resources. If the account is in an organization or uses Identity Center, resolve that first.
3. Close it from the Account settings page and confirm through the email address.
4. The account is suspended immediately, and all resources are terminated automatically.
5. You are charged through the end of the current month.
6. For 90 days it can be reopened by contacting AWS Support. After that it is permanently deleted.

(The free plan closes itself in the same way when it ends: see above.)

The most common mistakes

• Using the root user every day, or making access keys for it.
• No MFA, or one MFA device that is lost with the phone.
• Believing a budget is a limit. It is a warning.
• Forgetting a resource in another region and not seeing it in the console (the region selector shows one region at a time).
• Joining AWS Organizations from a free-plan account and being upgraded to a paid plan without noticing.
• Pasting access keys into a file or a repository. Use temporary credentials.
• Using the company account for personal experiments.

The cheat sheet

• Account = containers for resources and the bill, ID with 12 digits. Root user = master key. IAM = the everyday identities.
• New customers: free plan ($100 + up to $100, six months, closes at the end, 90 days to upgrade, select services, no charges) or paid plan. Over 30 always-free services. Terms: aws.amazon.com/free.
• First hour: root MFA (35 days to register, up to 8 devices), strong password, no root access keys, an everyday admin identity, IAM Identity Center for many people.
• Budget: AWS Budgets, cost budget, actual and forecast alerts, email or SNS. Updated up to three times a day. Warns, does not stop.
• CLI: aws sts get-caller-identity, aws configure list, aws configure sso or aws login, --region.
• Close: root user only. Suspended at once, resources terminated, billed to the end of the month, 90 days to reopen.

↑ All tutorials · AWS Regions and Availability Zones: Why Your Instance Disappeared →