At account creation

A secure password

At account creation make sure you pick a strong password. Understandably "strong password" is a vague explanation, but you type in something similar to a service like this:
https://bitwarden.com/password-strength/

Please note that even though Bitwarden is a trusted site, I would by no means enter any real password of mine. You can type in something similar in a similar format and length to give you a rough estimate how secure of a password you picked.

Here's an example I tried. It's deceptively easy to remember:

Once you've gone through account creation, you can log into your root account.

After logging in with root account

Setting up MFA

Root accounts for AWS are something that generally isn't meant to be used for day-to-day operations.
This account has all the power associated with your account. It can do literally anything.

To avoid abuse of this, the 2nd thing you should do is enable 2FA on your root account.

• To do this, navigate to your security credentials:

• At the Multi-factor authentication (MFA) section click on "Add MFA Device"

• Add a name above to associate it with the device and click on Authenticator APP

• Follow the on-screen instructions to add your device:

  

• It's asking for 2x MFA code, to get the 2nd code, just wait 30 seconds in your MFA application.

• Once done, you can log out of your account and test your MFA login

Setting up a budget alert

To alert you if your spending goes beyond a certain threshold, you can set up budget alerts.

To do this, navigate to Billing and Cost Management => Budgets => Create budget

You can then either set a monthly amount you're comfortable with along with an alert email.

This will alert you any time you're close to reaching your budget, however it'll do nothing else!

Update Billing Preferences

Navigate to Billing and Cost Management => Billing Preferences

Select both these options:

The first option will provide you alerts if you exceed Free Tier limits
The second option enables Cloudwatch alerts to be created around billing

Create a cloudwatch billing alarm

Navigate to CloudWatch => Alarms => Create alarm

For metric, select All => Billing => Total Estimated Charge

Specify metric to maximum => 6h . As noted above, anything quicker than 6h will cause the below warning, as billing updates aren't more frequent than 6h.

Choose a condition to trigger when it's greater than your set amount. As an example:

Click next, and on the next page create a target notification for the alarm.

Create a new topic and set your email address there as below:

Create this topic.

On the next page, give it a name and then review your alarm.

Once you did that, you'll receive an email that you need to confirm.

After all this, your alarm is active!

Do NOTs

• do not use the root account for day-to-day operations

• do not create an access key for the root account

• do not share your credentials with anyone

Creating a new day-to-day user

To avoid using your AWS root account, create a new user for logging in and performing daily activities.

Go to IAM => Users => Create user
Create a new user with AWS Management Console access, and select
I want to create an IAM user

Set them a password, then on the permissions page assign AdministratorAccess to them.

Click on create user and then log out and log back in with your newly created user.

On the newly created user, enable MFA just like you did with the root account.

Once you've done the above, your IAM => Dashboard should look like this:

And that's done!

Of course, there's much more you can do to enhance security, but the steps outlined above provide a solid starting point for those just beginning their journey.