AWS account setup: budgets, MFA and the free-tier trap
The cost and security groundwork done before provisioning anything billable — budgets vs Cost Explorer, why MFA matters most on root, and what the free tier does not protect you from.
Before creating a single billable resource, the first work on AWS was cost and security groundwork. This is the platform’s own rule made concrete: the guardrail precedes the provisioning, never follows it. Here is what I set up and what I took from it.
Budgets vs the alert — and vs Cost Explorer. A Budget lets you set a spending threshold on AWS; the alert is the notification that fires when spending crosses it, either forecasted (“about to reach”) or actual (“have reached”). I set up a Budget with an email alert at a low threshold. The point worth understanding is that Budgets is proactive — it watches and warns before or as spend happens — which is the opposite of Cost Explorer. Cost Explorer is reactive: it breaks spend down across services, time and usage type, so you read it after the fact to see where money went. Budgets warns you something is wrong; Cost Explorer tells you what.
Why the budget alarm is set low. For a low-traffic static site the expected spend is close to zero, often within free-tier allowances. So the alarm is a tripwire, not a limit I expect to approach — if it ever fires, something genuinely unexpected is happening and I want to know immediately.
Why MFA matters most on the root account. The root account is where all access originates, and unlike an IAM user it cannot be permission-restricted. An IAM user’s power is bounded by the policies attached to it, so if its credentials leak, the damage is limited to what it was allowed to do. Root has unrestricted, unremovable power — over billing, over every resource, over the account itself — and there is no scoped-permission safety net to contain a compromise. So MFA is the critical extra layer specifically on root, because it is the only thing standing between an attacker and total account control. I enabled MFA on both root and my IAM user, and I use the IAM user, not root, for daily work.
What the free tier does NOT protect you from. The dangerous assumption is “free tier means I cannot be charged.” It is not a spending cap — it is a discount on the first slice of specific services. It will happily bill you for exceeding a free-tier allowance, for using services that have no free tier at all, and for 12-month free items once the first year expires. That last one catches people out with a surprise bill months later. This is exactly why the budget alarm matters: it is the real protection the free tier does not give you.
If I woke up to a surprise bill. I would open Cost Explorer, group by service to find which one jumped, then drill into when and what usage drove it — the reactive counterpart to the Budget that first warned me.
The takeaway. The whole of this step is one idea: on a pay-as-you-go platform, you put the guardrails up before you build, because the free tier is a discount not a cap, and the root account is the one identity you cannot make safe with permissions — only with a second factor.