How to Set Up a New AWS Account Securely on the Free Tier (2026)

This guide is for anyone opening a brand-new AWS account in 2026, whether to learn, to study for a certification or to host a side project, who wants it locked down and unable to surprise them with a bill. By the end you will have a root user that is protected and put away, budgets and alerts that email you before money moves, a daily-use identity with MFA, a CloudTrail trail recording every API call, and a clear picture of what the new credit-based free tier does and does not cover. Commands were checked against current AWS documentation and AWS CLI 2.39.3; aws login needs at least 2.32.0. You need an email address, a phone, a payment card for identity verification, and ideally a password manager and a hardware key or phone that supports passkeys.

How the AWS free tier works in 2026

AWS replaced the old 12-month free tier for accounts created on or after 15 July 2025. New accounts get $100 in credits at sign-up and can earn up to $100 more through five starter activities worth $20 each: launch and terminate an EC2 instance, try RDS, build a Lambda function with a function URL, send a prompt in the Bedrock playground, and set up a budget in AWS Budgets. More than 30 services also keep always-free monthly allowances.

At sign-up you pick one of two plans. The Billing User Guide spells out the difference:

• Free plan: you cannot incur charges. Access is limited to select services (no Savings Plans, Reserved Instances or some Marketplace offers). The plan ends after six months or when credits run out, whichever comes first, and then the account closes. AWS keeps your content for 90 days, during which you can upgrade to Paid and get it back.
• Paid plan: all services, credits applied automatically, normal pay-as-you-go pricing beyond them. The account does not close when credits run out.

One detail catches people out. A Free plan account is upgraded to Paid automatically if you join AWS Organizations, set up Control Tower, and several other actions listed in the same guide. That matters in Step 5, because IAM Identity Center for console access needs Organizations.

If you are learning, choose the Free plan. It is the first AWS account type that structurally cannot run up a bill, and you can upgrade whenever you outgrow it.

Step 1: Sign up and choose the Free plan

Go to aws.amazon.com/free and create the account. Three choices here matter later:

1. Use an email address you will keep for years, ideally an alias you control (for example aws-root@yourdomain) rather than a work address you will lose. The root user is tied to it, and so are billing and Free Tier alerts.
2. Generate the root password in a password manager. You will rarely use it.
3. Choose the Free plan unless you already know you need Organizations, Reserved Instances or Marketplace.

Once you have CLI access (Step 5), you can read the plan state directly. The freetier API is documented in the AWS CLI reference:

# AWS CLI 2.39.3. Shows plan type (FREE or PAID), status, remaining credits and expiry.
aws freetier get-account-plan-state --region us-east-1

# List the $20 starter activities you have not finished yet.
aws freetier list-account-activities \
  --filter-activity-statuses NOT_STARTED IN_PROGRESS \
  --query 'activities[].{Title:title,Status:status,Credit:reward.credit.amount}' \
  --output table --region us-east-1

The response has accountPlanType, accountPlanStatus (NOT_STARTED, ACTIVE or EXPIRED), accountPlanRemainingCredits and accountPlanExpirationDate. Put that expiry date in your calendar now.

Step 2: Lock down the root user with MFA

The root user can do everything, including closing the account and changing the payment method, and IAM policies cannot restrict it. AWS has enforced MFA for root users across all account types since June 2025, so you will be pushed to register a device at first sign-in anyway. Do it properly:

1. Sign in as root, open IAM, then Security credentials for the root user, and choose Assign MFA device.
2. Register a passkey or security key first. AWS supports FIDO2 passkeys and lets the root user and each IAM user register up to eight MFA devices, so register a second one (another key, or an authenticator app) and store it somewhere separate. A lost single MFA device is the most common way people lock themselves out.
3. Confirm there are no root access keys. If there are any, delete them.
4. Under Account, set the security alternate contact so AWS security notices reach someone other than the root inbox.
5. Under Account, enable IAM user and role access to Billing information, otherwise the admin user you create in Step 5 cannot see bills or budgets.

Later, from the CLI, you can verify the result and set the contact without the console:

# Expect AccountMFAEnabled = 1 and AccountAccessKeysPresent = 0.
aws iam get-account-summary \
  --query 'SummaryMap.{RootMFA:AccountMFAEnabled,RootKeys:AccountAccessKeysPresent}'

# Security alternate contact (all four fields are required).
aws account put-alternate-contact \
  --alternate-contact-type SECURITY \
  --name "Ajay Kumar" \
  --title "Owner" \
  --email-address security@example.com \
  --phone-number "+44-20-0000-0000"

Then sign out of root and do not use it again for daily work.

Step 3: Create budgets and billing alerts

Even on the Free plan, budgets are worth it: they show how quickly you are burning credits, and they keep protecting you the day you upgrade. Setting up a budget is also one of the $20 activities.

In Billing and Cost Management, Budgets, Create budget, pick Use a template, then Zero spend budget. The budget templates page describes it as a budget that notifies you once spending exceeds Free Tier limits. Then add a monthly cost budget with credits excluded, so it shows real usage instead of a net $0. Here is the CLI version, using the documented create-budget structure:

cat > budget.json <<'EOF'
{
  "BudgetName": "monthly-gross-usage",
  "BudgetLimit": { "Amount": "10", "Unit": "USD" },
  "BudgetType": "COST",
  "TimeUnit": "MONTHLY",
  "CostTypes": { "IncludeCredit": false }
}
EOF

cat > notify.json <<'EOF'
[
  {
    "Notification": {
      "NotificationType": "ACTUAL",
      "ComparisonOperator": "GREATER_THAN",
      "Threshold": 50,
      "ThresholdType": "PERCENTAGE"
    },
    "Subscribers": [{ "SubscriptionType": "EMAIL", "Address": "you@example.com" }]
  },
  {
    "Notification": {
      "NotificationType": "FORECASTED",
      "ComparisonOperator": "GREATER_THAN",
      "Threshold": 100,
      "ThresholdType": "PERCENTAGE"
    },
    "Subscribers": [{ "SubscriptionType": "EMAIL", "Address": "you@example.com" }]
  }
]
EOF

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
aws budgets create-budget \
  --account-id "$ACCOUNT_ID" \
  --budget file://budget.json \
  --notifications-with-subscribers file://notify.json
# No output means success. Check with:
aws budgets describe-budgets --account-id "$ACCOUNT_ID" --query 'Budgets[].BudgetName'

Two more alerts arrive without any work. Free Tier usage alerts email the root address when you pass 85% of a service's free allowance (change the address under Billing preferences, Alert preferences), and Free plan accounts get periodic emails about credit balance and plan expiry. Open Cost Explorer once, too: new Cost Explorer users get a default Cost Anomaly Detection AWS services monitor and daily email subscription, which you can confirm with aws ce get-anomaly-monitors. It only emails when actual spend is over $100 and 40% above expected, so treat it as a backstop, not a budget.

Step 4: Choose your home Region

Pick one Region close to you and do everything there, so a forgotten resource is easy to find. Two exceptions: IAM, Budgets and billing are global, and CloudWatch billing metrics only exist in us-east-1. Regions launched since 2019 are opt-in, so the list you see by default is shorter than the full map.

# Set your home Region for the CLI (London here; pick your own).
aws configure set region eu-west-2

# Which Regions are enabled for this account?
aws account list-regions \
  --region-opt-status-contains ENABLED ENABLED_BY_DEFAULT \
  --query 'Regions[].RegionName' --output text

Choosing us-east-1 by default is not wrong, since new services often launch there first, but it is the Region most outage write-ups mention. The 2025 to 2026 cloud outage postmortems are a useful read before you make it your only one.

Step 5: Create a daily-use admin identity

AWS's preferred answer is IAM Identity Center. The catch for free tier users is in the Identity Center documentation: on a standalone account, enabling it creates an AWS Organization, and creating an organization upgrades a Free plan account to Paid, with the warning that Free Tier credits expire immediately. (The Billing guide says remaining credits normally carry over on upgrade, so treat the Organizations route as the one that can cost you your credits.) An account instance of Identity Center avoids Organizations but does not support permission sets, so it cannot give you access to the AWS console at all.

So the choice follows your plan.

On the Free plan: an IAM user with MFA and aws login. In IAM, create a user (for example ajay-admin), enable console access, attach AdministratorAccess, and assign it its own passkey MFA. Do not create access keys. Since November 2025, the CLI can use your console sign-in instead. According to the AWS Security Blog, credentials rotate every 15 minutes and last up to 12 hours:

aws --version            # must be aws-cli/2.32.0 or later
aws login --profile learn
# A browser opens; choose "Continue with Root or IAM user", sign in as ajay-admin with MFA.
aws sts get-caller-identity --profile learn
# {
#   "UserId": "AIDA...",
#   "Account": "123456789012",
#   "Arn": "arn:aws:iam::123456789012:user/ajay-admin"
# }

On the Paid plan: Organizations and IAM Identity Center. Enable Identity Center in your home Region (that becomes its primary Region; an organization instance can be replicated to more Regions later), create a user, create a permission set from AdministratorAccess, and assign the user to your account with that permission set. Then configure the CLI:

aws configure sso --profile learn
# SSO session name: learn
# SSO start URL: https://d-xxxxxxxxxx.awsapps.com/start
# SSO region: eu-west-2
aws sso login --profile learn
aws sts get-caller-identity --profile learn

Either way, nothing on your laptop holds a long-lived key. The same idea applies to CI: use GitHub Actions OIDC rather than storing keys as secrets.

Step 6: Turn on CloudTrail

Every account already gets 90 days of management event history at no charge, and per the CloudTrail pricing page, the first copy of management events delivered to S3 by a trail is also free (you pay only for S3 storage, normally a few cents covered by credits). A trail gives you history beyond 90 days, which is what you want after something odd happens. The bucket policy below is AWS's documented CloudTrail policy with the aws:SourceArn condition:

REGION=eu-west-2
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
BUCKET="cloudtrail-${ACCOUNT_ID}-${REGION}"
TRAIL=management-events

# For us-east-1, omit --create-bucket-configuration.
aws s3api create-bucket --bucket "$BUCKET" --region "$REGION" \
  --create-bucket-configuration LocationConstraint="$REGION"

cat > trail-bucket-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck20150319",
      "Effect": "Allow",
      "Principal": { "Service": "cloudtrail.amazonaws.com" },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::${BUCKET}",
      "Condition": { "StringEquals": {
        "aws:SourceArn": "arn:aws:cloudtrail:${REGION}:${ACCOUNT_ID}:trail/${TRAIL}" } }
    },
    {
      "Sid": "AWSCloudTrailWrite20150319",
      "Effect": "Allow",
      "Principal": { "Service": "cloudtrail.amazonaws.com" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::${BUCKET}/AWSLogs/${ACCOUNT_ID}/*",
      "Condition": { "StringEquals": {
        "s3:x-amz-acl": "bucket-owner-full-control",
        "aws:SourceArn": "arn:aws:cloudtrail:${REGION}:${ACCOUNT_ID}:trail/${TRAIL}" } }
    }
  ]
}
EOF
aws s3api put-bucket-policy --bucket "$BUCKET" --policy file://trail-bucket-policy.json

# Multi-Region so activity in a Region you never use still gets recorded.
aws cloudtrail create-trail --name "$TRAIL" --s3-bucket-name "$BUCKET" \
  --is-multi-region-trail --enable-log-file-validation --region "$REGION"
aws cloudtrail start-logging --name "$TRAIL" --region "$REGION"
aws cloudtrail get-trail-status --name "$TRAIL" --region "$REGION" --query IsLogging
# true

Do not create a second trail for the same management events. That copy is billed.

Step 7: Avoid surprise AWS bills

On the Free plan you cannot be charged, but you can burn credits fast and get the account closed early. On the Paid plan these are the usual sources of a bill nobody expected:

• Public IPv4 addresses cost $0.005 an hour each since February 2024, attached or not. An unattached Elastic IP is the classic leftover.
• NAT gateways bill hourly plus per GB processed. For learning, use public subnets or VPC endpoints instead.
• Stopped EC2 instances stop compute charges but their EBS volumes and snapshots keep billing.
• Resources in another Region. Group Cost Explorer by Region once a week.
• Public S3 data. New buckets block public access by default; set it account-wide too:

aws s3control put-public-access-block --account-id "$ACCOUNT_ID" \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

When you finish a lab, delete it the same day. Better still, build labs with Terraform so destroy is one command; the Terraform state guide covers where to keep state safely.

Troubleshooting

Symptom	Likely cause	Fix
aws: error: argument command: Invalid choice for login	AWS CLI older than 2.32.0	Upgrade the CLI and rerun aws --version
Identity Center shows "Enable IAM Identity Center with AWS Organizations"	Standalone account; this creates an organization and upgrades a Free plan to Paid	Use an IAM user with MFA on the Free plan, or upgrade deliberately first
Budget shows $0 actual spend while you use services	Credits are netted out by default	Set "IncludeCredit": false in CostTypes
A service or purchase option is greyed out	Free plan excludes it (Savings Plans, Reserved Instances, some Marketplace)	Upgrade to the Paid plan if you need it
InsufficientS3BucketPolicyException on create-trail	Bucket policy missing, wrong bucket name, or aws:SourceArn does not match the trail	Reapply the policy with the exact Region, account ID and trail name
Admin user gets access denied on Billing or Budgets	IAM access to billing was never activated	As root, enable IAM user and role access to Billing information under Account
No Free Tier usage alert emails	Alerts go to the root email, or alerts are off	Check Billing preferences, Alert preferences
Account closed and console says plan expired	Free plan hit six months or ran out of credits	Upgrade to Paid within 90 days to recover resources
Lost the only root MFA device	Single device registered	Use the account recovery flow on the sign-in page, then register at least two devices
Small charges from a Region you never chose	A resource created with a different default Region	Filter Cost Explorer by Region, delete it, and set aws configure set region

FAQ

Is the AWS free tier really free in 2026?

On the Free plan, yes: AWS states you cannot incur charges, and the account closes after six months or when your $100 to $200 of credits run out. On the Paid plan, credits cover eligible usage and you pay normal prices beyond them, so budgets matter.

Can I use IAM Identity Center on the AWS Free plan?

Not for console access without leaving the Free plan. Enabling Identity Center on a standalone account creates an AWS Organization, which upgrades the account to Paid. On the Free plan, use an IAM user with MFA and the aws login command instead.

What happens when the AWS free plan ends?

Your account closes automatically and you lose access to resources and data. AWS keeps your content for 90 days; upgrading to the Paid plan within that window restores access and applies any remaining credits.

Do I need CloudTrail if I have event history?

Event history covers 90 days of management events for free. A trail keeps a durable copy in S3 for as long as you want, and the first copy of management events is free. For a personal account, one multi-Region trail is enough.

When I hand someone a new AWS account, the first thing I check is aws iam get-account-summary: root MFA on, root keys absent. The second is that a budget exists with credits excluded and an email I know is read. Everything else in this guide can be fixed later; those two cannot be fixed after the bill or the breach. If you are deciding which cloud to learn in the first place, I compared the three in AWS vs Azure vs GCP 2026. Official references: AWS Free Tier plans, tracking Free Tier usage, enabling IAM Identity Center and CloudTrail pricing.

---

Related: How to Use GitHub Actions OIDC With AWS, GCP and Azure (2026), Cloud Outages 2025-2026: What 7 Official Postmortems Actually Teach and Terraform State in 2026: S3 Locking Replaced DynamoDB, What Else Changed.