This lesson's interactive features are locked, please to keep using them

AWS Account Creation

It's time to create your AWS account (if you don't already have one)! Here are a few things to understand first:

Free tier vs. paid: If you've never had an AWS account before, you can create one with free tier eligibility. Free tier has limits on available services and usage, and you'll be charged if you exceed those limits. AWS also tends to offer introductory credits so you can try paid-tier services for a period of (currently) 6 months. If you're eligible for free tier and intro credits, it should be more than enough to complete this course. If you plan to use an existing paid account, don't worry, we'll keep costs very low.
Account creation requires adding billing info: Yes, this also applies to free-tier accounts. AWS will charge ~$1 to your billing method to make sure it's real, then refund it.
Root login: When you first create an AWS account, you'll have a root user login linked to your email address. The root user has full control of the account! Guard this login carefully and use it only for tasks that require it.
IAM users: AWS has a system called Identity and Access Management (IAM), which allows you to set up users and roles under your account that have exactly the permissions they need to do certain work. We'll cover IAM in detail later; you'll use the system a little bit here, to create a non-root admin user for your account.
MFA: We (and AWS) recommend setting up multi-factor authentication (MFA), at a minimum, for the root user of your AWS account.

Assignment

Let's get your AWS account up and running.

If you're creating a new AWS account, make sure the email address that you use is not the owner of another AWS account. (Surprisingly, Amazon allows that, though it's a terrible idea.)

Create a free AWS account (if possible; if you've previously opened an AWS account, you can use that one).
- Select the "personal" account option, and fill out the form.
- Follow the instructions step by step. For example, you'll need to verify your email address and probably a phone number as well.
- Again, you will need to add billing info, but as long as you stay on the free tier, you won't be charged beyond the small temporary hold that's placed on your card to verify it's real (and which will be refunded in a few days).
- Select the free support plan.
  
  We'll aggressively remind you to delete resources to keep you within free-tier limits, but know that if you leave certain resources up for long periods of time, you may be charged.
Log into your new AWS account as the root user (just this once!), and set up MFA.
- If you're not there already, navigate to the AWS console and select the "Root user" login option.
- Sign in with the email address and password that you used to create the account.
- If prompted after login, set up MFA using the additional factor of your choice (we recommend the Authy app if you don't already have a preference).
- If you were automatically logged in after creating a new account, you can add MFA from the IAM dashboard.
Create an admin-level IAM user for day-to-day account management. This will be your primary AWS login for the remainder of the course.
- Navigate to the IAM dashboard. You can also use the search bar at the top of the console to find it.
- Click on "Users" under "Access Management" in the menu on the left, then click "Create user."
- Give the IAM user a name like zach-admin (using your own name).
- Check the box "Provide user access to the AWS Management Console."
- Have AWS auto-generate an initial password, and leave the box checked to require a password reset on first login.
- Create a new group for this user, called Administrators. Attach the AdministratorAccess policy to the group. Only the one policy is needed.
- Assign the IAM user that you're creating to the new group.
- On the "Review and create" step, if everything looks right, click "Create user."
- Download the credentials CSV file. Note that AWS gives you a sign-in URL, the IAM username, and the initial password. The sign-in URL has your AWS account ID in it.
In the web console, log out of your root user, then log in as the new IAM admin user.
- Use the sign-in URL from the credentials CSV.
- The account ID should be pre-populated on the sign-in page, but save the ID number in case you need it for any future logins.
- Enter the username you created and the auto-generated initial password.
- You'll be prompted to set a new password for the IAM user. Create one and save it.
- If prompted, set up MFA for the IAM user as well (not as critical as with the root user, but still recommended).
  
  From this point on, use the IAM admin user unless a root user login is absolutely necessary. We'll be learning a lot more about IAM and scoped security throughout this course.
Go back to your terminal and authenticate the AWS CLI using the IAM admin user.
- Make sure you're using AWS CLI 2.32.0 or newer.
- Run aws login and follow the browser auth flow.
- If aws login is denied, your IAM user or group may be missing the permissions required for local development sign-in.
Verify your logged-in status.
- Run:
```
aws sts get-caller-identity
```
- The output should include your UserId, Account number, and Arn.
- The Arn should include iam and end with the IAM username you created.

Run and submit the CLI tests.