Getting started with AWS — account, console, regions, free tier and AWS CLI

Objective

Open an AWS account the right way: secure it within the first hour, choose a region suited to users in Morocco, understand what the free tier covers, then install and configure the AWS CLI to work from the command line with several profiles.

Key points

• An AWS account is a container for resources and billing, identified by a 12-digit number. The sign-up e-mail address becomes the all-powerful root user.
• The root user gets MFA immediately and is never again used for daily work: you work with IAM or IAM Identity Center identities.
• AWS is divided into regions (eu-south-2 Spain, eu-west-3 Paris…) and availability zones (eu-south-2a, b, c). Most resources belong to one region.
• The free tier has precise limits and changed in 2025: a budget with an alert is the first thing to create.
• AWS CLI v2 reads its configuration from ~/.aws/config and ~/.aws/credentials, organized into profiles.

1. The AWS account

To open an account, you need an e-mail address, a phone number and a bank card that accepts international payments in dollars (an international Moroccan card usually works; check your limits for payments abroad with your bank).

Good practices at sign-up:

The root user

The root user can do everything, including closing the account or changing the payment method, and no policy can restrict it inside the account. So:

1. enable MFA (ideally a FIDO2 security key);
2. create no access key for it;
3. create an administration identity for everyday work (lesson 1.2);
4. use the root user only for the rare tasks that require it (some billing settings, closing the account, recovery).

One account or several?

A startup often begins with a single account. As soon as there is production, you separate with AWS Organizations:

Organization "startup"
├── management account (billing, nothing else)
├── production account
├── preproduction account
└── security account (CloudTrail logs, audit)

The boundary between accounts is the strongest isolation in AWS: a mistake in preproduction cannot affect production.

2. The management console

The web console (console.aws.amazon.com) lets you do everything with the mouse. Landmarks:

• at the top right, the region selector: the number one cause of "my instances have disappeared!" (they are simply in another region);
• the services search bar;
• the account menu: account number, billing, security credentials;
• CloudShell: a terminal in the browser with the AWS CLI already configured with your permissions. Handy for getting started, with nothing to install.

Some services are global (IAM, Route 53, CloudFront, Organizations): the region selector has no effect on them.

3. Regions and availability zones

Regions close to Morocco

At the time of writing, AWS has no region in Morocco. The list of regions and of services per region changes: check the official "Global Infrastructure" page before a project.

Opt-in regions

Regions opened after March 2019 (including eu-south-2, eu-south-1, af-south-1) are disabled by default. You must enable them in the account settings (account menu → "Account" → "AWS Regions"), which can take a few minutes.

# See the status of the account's regions (enabled or not)
aws account list-regions --query 'Regions[].[RegionName,RegionOptStatus]' --output table

Zones

Each region has at least three availability zones. Their name (eu-south-2a) is a label specific to your account: zone "a" in another account is not necessarily the same data center. To refer to the same zone across two accounts, you use the zone ID (in the form <short-code>-az1), shown by the command below.

aws ec2 describe-availability-zones --region eu-south-2 \
  --query 'AvailabilityZones[].[ZoneName,ZoneId,State]' --output table

Choosing your region: a Casablanca startup

A delivery application for grocery stores in Casablanca and Rabat:

A common choice: a nearby primary region (Spain or Paris), after checking that all the services you need are available there, and a second region for backup copies. The question of personal data (law 09-08, CNDP) must be handled beforehand: see the "Cloud fundamentals" course, lesson 3.1.

4. The free tier and the bill

The free tier

AWS has long offered a free tier to discover its services. It was deeply changed in 2025: new accounts receive starting credits and choose between a time-limited free plan and a paid plan; older accounts were covered by a "12 months free" offer on some services, plus "always free" services within monthly limits.

The exact rules (amounts, duration, services covered) change: read the official free tier page when you open the account, and remember these principles:

• "free" means within a limit (hours, GB, requests);
• some services are never free (NAT gateway, public IPv4 addresses beyond what is included, some instance sizes);
• whatever you forget to turn off keeps consuming.

Protect yourself from day one

1. Create a budget with an e-mail alert at a few dollars (AWS Budgets, lesson 3.3).
2. Turn on billing alerts and check the Billing and Cost Management page every week at the beginning.
3. Delete what you create for your trials, in the right region.

# A monthly budget of 10 dollars with an alert at 80% (JSON files prepared in advance)
aws budgets create-budget --account-id 123456789012 \
  --budget file://budget.json --notifications-with-subscribers file://alertes.json

5. AWS CLI

Install version 2

# Linux x86_64 (on a machine with Internet access)
curl -sSLo awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip"
unzip -q awscliv2.zip
sudo ./aws/install
aws --version          # aws-cli/2.x.x Python/3.x Linux/...

Prefer this official installer or CloudShell: the awscli package of some distributions is an old version 1.

Signing in: the methods

The configuration files

# ~/.aws/config: settings per profile (no secrets here)
[default]
region = eu-south-2
output = json

[profile formation]
region = eu-west-3
output = table

[profile prod]
sso_session = startup
sso_account_id = 123456789012
sso_role_name = AdministrateurProd
region = eu-south-2

[sso-session startup]
sso_start_url = https://startup.awsapps.com/start
sso_region = eu-west-3

• ~/.aws/config: regions, output format, SSO profiles;
• ~/.aws/credentials: the access keys if you use any (a file to protect with chmod 600, never in Git);
• in config, sections are written [profile name]; in credentials, simply [name].

Choosing the profile and the region

aws s3 ls --profile formation           # a profile for one command
export AWS_PROFILE=prod                 # a profile for the whole terminal session
aws ec2 describe-instances --region eu-west-3   # the region option overrides the profile's region
aws configure list                      # where the current settings come from
aws sts get-caller-identity             # "who am I?": account, user or role

aws sts get-caller-identity is the command to type as soon as something does not work: it tells you which account and which identity you are really working with.

Formatting the results

aws ec2 describe-regions --output table
# --query filters the JSON response with JMESPath
aws ec2 describe-instances \
  --query 'Reservations[].Instances[].[InstanceId,InstanceType,State.Name]' --output text

Formats: json (the default, for scripts), table (readable), text (for grep, awk), yaml.

Common pitfalls

• Using the root user for daily work, or worse, creating access keys for it.
• Looking for your resources in the wrong region: check the region selector and the --region option.
• Believing everything is free during the trial: NAT gateways, public IPs, large volumes or large instances are billed. Create a budget.
• Copying access keys into a script or a Git repository: bots find them within minutes and launch mining machines at your expense.

Lab

The lab has no network access and no AWS CLI: you prepare the files that an engineer sets up on their workstation. You write ~/.aws/config with a default profile in Spain then a formation profile in Paris, a small valid inventory script, and the record of the account choices.

cat /root/.aws/config
sh -n /root/aws/inventaire.sh && echo "syntaxe correcte"

Quiz

1. How many digits does an AWS account number have?
2. Name two rules for the root user.
3. Why does the eu-south-2 region not appear in a brand-new account?
4. In ~/.aws/config, how do you write the header of a profile named formation?
5. Which command shows which account and which identity the CLI is working with?

General references: official AWS documentation (not reproduced). Entirely original MasterLinux text.