AWS Lab 01 — Account Setup & IAM Foundations

☁ AWS

Lucent Grid · Cloud Labs

Initialising console environment...

AWS

Amazon Web Services

Services IAM Billing

root (lab-account) us-east-1 ▾

IAM — Identity and Access Management

IAM

📊 Dashboard

Access management

👤 Users

👥 User groups

🔑 Roles

📋 Policies

🔒 Identity providers

🔒 Account settings

Account settings

⚙ Password policy

🔐 MFA devices

🔒 Security Token Service

Reports

🔒 Access Analyzer

🔒 Archive rules

🔒 Analyzers

🔒 Settings

🔒 Credential report

🔒 Organization activity

🔒 Service control policies

🔒 Declarations

Quick links

🔒 My security credentials

🔒 My jobs queue

IAM Users

User Groups

❌

Root MFA Status

Security recommendations

Address these to improve your account security posture

Enable MFA for the root account — The root account has unrestricted access.

NOT DONE

Create an IAM user — Avoid using the root account for day-to-day tasks.

NOT DONE

Set a strong password policy — Enforce minimum requirements for all users.

NOT DONE

Assign users to groups — Manage permissions via groups, not individual users.

NOT DONE

⚠ The root account does not have MFA enabled. This is a critical security risk.

Add MFA device for root account

Device name*

MFA device type

User name	Groups	Last sign-in	MFA
No IAM users yet. Click Create user to add your first user.

💡 Best practice: Create an IAM user for day-to-day tasks. The root account should only be used for account-level operations.

User name*
Must be unique within this account. Case-sensitive.

Provide user access to the AWS Management Console
If you're creating a user for a person who needs to sign in to the console, enable this.

💡 Attach permissions policies to groups, then assign users to groups. This is easier to manage than attaching policies to individual users.

Group name	Users	Attached policies
No groups yet. Click Create group to get started.

Group name*

Attach permissions policies

Select one or more policies to attach to this group.

Policy name	Type	Description
AdministratorAccess	AWS managed	Provides full access to all AWS services and resources
PowerUserAccess	AWS managed	Full access to services except IAM, Organizations, and Account
ReadOnlyAccess	AWS managed	Read-only access to all AWS services and resources
IAMFullAccess	AWS managed	Provides full access to IAM via the AWS Management Console
IAMReadOnlyAccess	AWS managed	Provides read-only access to IAM
IAMUserChangePassword	AWS managed	Provides the ability for an IAM user to change their own password
AWSBillingReadOnlyAccess	AWS managed	Provides read-only access to billing and cost management
AmazonS3FullAccess	AWS managed	Provides full access to all buckets and objects in Amazon S3
AmazonS3ReadOnlyAccess	AWS managed	Provides read-only access to all buckets and objects in Amazon S3
AmazonEC2FullAccess	AWS managed	Provides full access to Amazon EC2 via the AWS Management Console
AmazonEC2ReadOnlyAccess	AWS managed	Provides read-only access to Amazon EC2 via the AWS Management Console
AmazonRDSFullAccess	AWS managed	Provides full access to Amazon RDS via the AWS Management Console
AWSLambda_FullAccess	AWS managed	Grants full access to AWS Lambda, and other services required for Lambda development
AmazonVPCFullAccess	AWS managed	Provides full access to Amazon VPC via the AWS Management Console
AWSCloudTrail_FullAccess	AWS managed	Provides full access to AWS CloudTrail
CloudWatchFullAccess	AWS managed	Provides full access to CloudWatch
AmazonDynamoDBFullAccess	AWS managed	Provides full access to Amazon DynamoDB
AWSCodePipeline_FullAccess	AWS managed	Provides full access to AWS CodePipeline and supporting services
AmazonSNSFullAccess	AWS managed	Provides full access to Amazon SNS
SecurityAudit	AWS managed	The security audit template grants access to read security configuration metadata

Password policy

Set minimum requirements for IAM user passwords in this account.

⚠ No custom password policy is set. AWS defaults apply (minimum 8 characters, no complexity requirements).

Roles are covered in Lab 02 — IAM Roles & Instance Profiles. Come back then!

Deep-dive policy authoring is covered in Lab 03 — Writing IAM Policies.

Billing and Cost Management

Billing Preferences

Configure alerts and invoice delivery

Free Tier usage alerts

Receive Free Tier usage alerts
AWS will email you when you approach or exceed Free Tier limits.

CloudWatch billing alarm

Create an alarm that emails you when estimated charges exceed a threshold.

Alert me when monthly charges exceed $ Notify:

Policy Viewer

JSON policy document — read only

🛡 IAM Console

💰 Billing

📋 Policy Viewer

0 / 5 tasks complete 0 XP

00:00:00

🎯 Lab Objectives

Enable MFA on root account

Create a billing alarm

Create an IAM user

Set account password policy

Create Admins, Developers & ReadOnly groups

📋 GUIDE

☁ AWS LAB 01

Account Setup & IAM

Step-by-step guide — open if you get stuck

Objectives

Enable MFA on the root account

Create a billing alarm

Create an IAM user

Set an account password policy

Create three IAM groups with policies

Task 1 — Enable MFA on Root

Step by step

1In the IAM sidebar, click MFA devices

2Enter a device name — e.g. root-mfa

3Select Authenticator app from the dropdown

4Enter any 6 digits in code field 1 and any 6 digits in code field 2

5Click Add MFA

💡 In a real AWS account, you'd scan the QR code with Google Authenticator or Authy. In this lab, any 6 digits will work.

Task 2 — Billing Alarm

Step by step

1Click Billing in the taskbar or AWS top bar

2Enter your email and set a threshold (e.g. 5 for $5)

3Click Create billing alarm

Task 3 — Create an IAM User

Step by step

1In IAM sidebar, click Users → Create user

2Enter a username — e.g. admin-alex

3Tick Provide user access to the AWS Console

4Choose a password type and click Next

💡 The username must be at least 3 characters. Use lowercase letters and hyphens.

Task 4 — Password Policy

Step by step

1In IAM sidebar, click Account settings

2Click Edit password policy

3Check all complexity requirements and click Save changes

Task 5 — Create Groups

Step by step — repeat 3 times

1Click User groups → Create group

2Name: Admins — Attach: AdministratorAccess

3Name: Developers — Attach: PowerUserAccess

4Name: ReadOnly — Attach: ReadOnlyAccess

⚠ You must complete all three groups to get credit for this task.