Set Up an AWS Account and Host a Website

Create a secured AWS account and deploy a live static website on Amazon S3.

Introduction

30 Second Summary

Every time you visit a website, stream a video, or order food online, cloud computing is working behind the scenes. The best way to understand it is to get hands-on and build something real.

In this project, you will set up a brand-new AWS account and secure it following professional security practices. You will then deploy a personal website that is live on the internet for anyone to visit.

What You'll Build

Paste a public URL into any browser and watch your personal website load, hosted entirely on AWS and ready to share with anyone.

By the end of this project, you'll have:

A secured AWS account where MFA protects the root user and a dedicated IAM admin user handles daily work. The all-powerful root account stays locked away for emergencies only.
A live personal website on Amazon S3 that you can share with anyone by pasting a public URL into any browser.
An email alert from AWS Budgets the moment your spending rises above $0. No surprise bills.
Secret Mission: Serve your site over HTTPS from edge locations worldwide using Amazon CloudFront.

Do I need any prior AWS experience?

No. This project starts from zero and walks you through creating your AWS account. All you need is a Mac with a web browser and an authenticator app on your phone (such as Google Authenticator or Authy) for setting up multi-factor authentication.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

This step is your chance to commit to the project goal before any hands-on work begins.

Create Your AWS Account and Secure the Root User

Every AWS journey starts with an account. The root user you create during sign-up has unlimited power over everything in that account.

If someone gets hold of your root credentials, they own everything. Securing the root user immediately is the first thing any cloud professional does. The CLF-C02 exam tests this heavily under Domain 2: Security and Compliance, which is worth 30% of the exam.

In this step, get ready to:

Create a new AWS Free Plan account.
Enable multi-factor authentication on the root user.
Tour the AWS Management Console.

Create your AWS Free Plan account

The sign-up process takes about 10 minutes. You will need your email address, a phone number, and a valid payment method.

Open the AWS Free Tier page in your browser.
Click Create a free account.
Enter your root user email address and an AWS account name.
Click Verify email address and enter the verification code sent to your inbox.
Create a strong root user password using 8 to 128 characters with a mix of uppercase letters, lowercase letters, numbers, and symbols.
Click Continue.
Choose the Free plan when prompted.

What is the AWS Free Plan?

The AWS Free Plan is designed for new customers. You receive $100 in credits at sign-up, and you can earn up to $100 more by completing specific activities across AWS services.

The Free Plan lasts six months or until your credits run out. AWS will not charge your payment method unless you upgrade to a Paid plan.

Enter your contact information.
Read and accept the AWS Customer Agreement.
Add a valid payment method.

Why does AWS need a payment method?

AWS requires a payment method for identity verification. While you are on the Free Plan, AWS will not charge it. Think of it like a hotel holding a card on file without making a charge.

Complete phone verification by clicking Send SMS and entering the code you receive.
Choose the Basic Support plan (free of charge).
Click Complete sign up.

A confirmation page appears indicating your account is being activated. Check your email for an activation message. This usually takes a few minutes but can take up to 24 hours.

Haven't received your activation email?

Check your spam and junk folders.
Make sure you are checking the email address you used during sign-up.
If 24 hours have passed and you still have not received it, contact AWS Support.
Help me troubleshoot my AWS account activation.

Enable MFA on the root user

Your root user account is now live, but it has no extra protection beyond a password. Multi-factor authentication adds a second verification step using your phone. Every time you sign in, you will need both your password and a code from your authenticator app.

Open the AWS Management Console in your browser.
Sign in with your root user email address and password.
Click your account name in the top-right corner.
Select Security credentials.

What is multi-factor authentication?

MFA requires two forms of proof to sign in: something you know (your password) and something you have (a code from your phone). Even if someone steals your password, they cannot access your account without the code.

AWS now requires MFA for all root users. The CLF-C02 exam tests your understanding of MFA as a key security best practice.

Under Multi-factor authentication (MFA), click Assign MFA device.
Enter a Device name (for example, my-phone).
Select Authenticator app.
Click Next.

A QR code appears on screen. This is what your authenticator app scans to link your phone to your AWS account.

Open the authenticator app on your phone (Google Authenticator, Authy, or whichever you have installed).
Scan the QR code displayed on your screen.
Enter the current six-digit code from the app into the MFA code 1 field.
Wait for the code in your app to refresh to a new number.
Enter the new six-digit code into the MFA code 2 field.
Click Add MFA.

What do you expect to see under Multi-factor authentication now that you have set it up?

Click your account name in the top-right corner.
Select Security credentials.

Under Multi-factor authentication (MFA), you should see your MFA device listed with the device name you chose. This confirms your root user now requires a code from your phone every time you sign in.

MFA codes not accepted?

Make sure you entered two consecutive codes. Wait for the first code to expire in your authenticator app, then use the new code for MFA code 2.
Check that the time on your phone is set to automatic. MFA codes are time-based, so a clock mismatch causes them to fail.
Submit the codes promptly. If you wait too long, the time-based codes expire.
Help me fix my MFA codes not being accepted during AWS root user setup.

Tour the AWS Management Console

Click the Services menu at the top-left of the Console to see the full list of AWS services organized by category (Compute, Storage, Database, Security, and more).
Type S3 in the search bar at the top of the page.

You should see Amazon S3 appear in the search results. The search bar is the fastest way to find any service in the Console.

What is the AWS Management Console?

The AWS Management Console is the primary web interface for managing AWS services. It is one of several ways to interact with AWS.

The CLF-C02 exam tests your knowledge of how to access AWS services. The four main methods are the Console, the AWS CLI, SDKs, and APIs.

Your AWS account is created and your root user is locked down with MFA. Next, you will create a dedicated admin user so you never have to use the root user for daily tasks.

Create an IAM Admin User and Set Up a Cost Budget

In Step 1, you created your AWS account and locked down the root user with MFA. That handles security from outsiders.

The root user still has unlimited power over your entire account. Using it for everyday tasks is like carrying your house master key to the grocery store. In this step, you will create a separate admin user for daily work and set up a cost budget so you never get a surprise bill.

In this step, get ready to:

Create an IAM admin user with console access and admin permissions.
Sign in as the IAM user instead of the root user.
Set up a $1 cost budget in AWS Budgets to catch any unexpected charges.

Create an IAM admin user

Your root user can do anything in your account with no restrictions. AWS best practice is to create a separate IAM user for daily tasks and lock the root user away. This follows the principle of least privilege.

In the Console search bar at the top, type IAM and select the IAM service from the results.
In the left navigation pane, choose Users.
Choose Create user.
On the Specify user details page, enter admin-user in the User name field.
Check the box next to Provide user access to the AWS Management Console.

What is IAM?

IAM stands for Identity and Access Management. It lets you create individual users with their own credentials and control exactly what each user can do in your AWS account.

By default, a new IAM user has no permissions at all. You grant permissions by attaching policies, which you will do shortly.

Select I want to create an IAM user.
Under Console password, select Custom password and enter a strong password.
Optionally, uncheck Users must create a new password at next sign-in.
Choose Next.

Why not IAM Identity Center?

The console may suggest using IAM Identity Center instead. IAM Identity Center is designed for managing access across multiple AWS accounts in an organization.

For learning Cloud Practitioner fundamentals, a standard IAM user is the right choice. It directly teaches the IAM concepts the exam tests.

On the Set permissions page, choose Attach policies directly.
In the search box, type AdministratorAccess.
Select the checkbox next to AdministratorAccess.
Choose Next.

What does AdministratorAccess do?

AdministratorAccess is an AWS-managed policy that grants full permissions to all AWS services and resources. It is the broadest policy available.

You are attaching this policy directly to the user. The exam calls this an identity-based policy. You will see a different type of policy (a resource-based policy) when you work with S3 bucket policies later.

On the Review and create page, review the user details.
Choose Create user.
On the confirmation page, find the Console sign-in URL. Copy this URL and save it somewhere safe along with the username and password you just set.

What does the sign-in URL look like?

The sign-in URL includes your AWS account ID and looks something like https://123456789012.signin.aws.amazon.com/console/. You will use this URL to sign in as your IAM user instead of the root user.

Don't see the sign-in URL?

Make sure you are on the confirmation page that appeared right after choosing Create user. If you navigated away, go to IAM > Users > admin-user and check the Security credentials tab for the console sign-in link. You can also find it on the IAM Dashboard page.

help me find my IAM user sign-in URL

Sign in as the IAM user

Now that your IAM user exists, switch over to it. You should avoid using the root user for anything other than account-level tasks like billing changes.

Click your account name in the top-right corner of the console.
Choose Sign out.
Open the sign-in URL you copied from the confirmation page.
Enter admin-user as the IAM user name and enter the password you set.
Choose Sign in.

Click your account name in the top-right corner. You should see admin-user displayed in the dropdown, confirming you are no longer signed in as the root user.

What is the principle of least privilege?

The principle of least privilege means giving each user only the permissions they need to do their job. Your root user can do everything, including closing the entire account.

By creating a separate admin user for daily work, you reduce the risk of accidentally making irreversible changes with the root user. The Cloud Practitioner exam (Domain 2, 30% of the exam) tests this concept heavily.

Can't sign in as admin-user?

Double-check that you are using the IAM sign-in URL you copied, not the regular AWS sign-in page. The IAM sign-in page asks for an IAM user name and password, while the root sign-in page asks for an email address.

If the password is rejected, go back to IAM > Users > admin-user > Security credentials (while signed in as root) and choose Manage console access to reset the password.

help me sign in as my IAM admin user

Set up a cost budget using AWS Budgets

Your account is on the Free Plan with up to $200 in credits. Even so, a budget acts as a safety net in case you accidentally create something that costs money.

In the Console search bar at the top, type Budgets and select AWS Budgets.
Choose Create a budget.
Under Budget setup, select Use a template (simplified).
Choose the Monthly cost budget template.
Set the budgeted amount to 1 (one dollar).
Enter your email address in the email recipients field.
Choose Create budget.

What is AWS Budgets?

AWS Budgets lets you set custom cost thresholds and receive email alerts when your spending approaches or exceeds them. The $1 budget you just created will email you if your costs go above that amount.

The Cloud Practitioner exam (Domain 4, 12% of the exam) tests your knowledge of AWS cost management tools including Budgets, Cost Explorer, and pricing models.

Earn bonus Free Tier credits

Setting up a cost budget is one of five credit-earning activities for new AWS accounts. Completing it earns you $20 in additional Free Tier credits.

Before you check your budget, what do you expect to see on the AWS Budgets page?

Navigate to AWS Budgets (refresh the page or search for Budgets in the Console search bar).

You should see your monthly cost budget listed with a $1.00 budgeted amount and your email address set for alerts. This confirms your safety net is in place.

Don't see your budget?

Budgets can take a moment to appear. Refresh the page after a few seconds. If the budget still does not show, make sure you chose Create budget on the previous page and saw a success confirmation.

help me find my AWS budget

Your account is now secured with a dedicated admin user, and your budget will catch any unexpected spending. Next up, you will create an Amazon S3 bucket and upload your first website files.

Create an S3 Bucket and Upload Your Website

Your AWS account is secured and your budget is in place. Now it is time to use one of the most important services on the Cloud Practitioner exam: Amazon S3.

S3 is an object storage service. You store files (called objects) inside containers (called buckets). In this step, you will create a bucket, upload a website file, and see what happens when you try to visit it.

In this step, get ready to:

Create an S3 bucket with a globally unique name.
Create an HTML website file and upload it to your bucket.
Try to access your file through its public URL and see what S3 does by default.

Create an S3 bucket

Every file you store in S3 lives inside a bucket. Each bucket name must be unique across every AWS account in the world.

In the Console search bar at the top, type S3 and select S3 from the results.
In the left navigation pane, choose General purpose buckets.
Choose Create bucket.
In the Bucket name field, enter a globally unique name. For example, my-first-website-yourname-2026, replacing yourname with your actual name.
Leave the AWS Region as the default, or choose one close to you.
Leave all other settings at their defaults. Confirm that Block all public access is checked.
Scroll to the bottom and choose Create bucket.

You should see a green success banner at the top of the page, and your new bucket listed under General purpose buckets.

Why does my bucket name need to be globally unique?

Every S3 bucket name must be unique across all AWS accounts worldwide. S3 uses the bucket name as part of the URL to your files, so no two buckets anywhere on AWS can share the same name.

Adding your name and the year to the bucket name makes collisions unlikely.

Seeing a "Bucket name already exists" error?

Someone else already has a bucket with that name. Try adding more characters to make it unique, like extra numbers or your full name.

help me pick a unique S3 bucket name

Create and upload your website files

Your bucket is empty. You need a website file to put in it. You will create an index.html file on your Mac, then upload it to S3.

Press Cmd+Space to open your search bar.
Type Terminal and press Enter to open it.

Move to your Desktop by running this command:

cd ~/Desktop

Create a project folder, move into it, and create your HTML file by running these commands:

mkdir my-aws-website
cd my-aws-website
touch index.html

Confirm the file exists by running:

ls

You should see index.html in the output.

Open the file in a text editor by running:

open -a TextEdit index.html

Use any text editor you prefer

If you have VS Code or another code editor installed, feel free to use that instead. The command above opens Mac's built-in TextEdit.

If TextEdit opens in rich text mode, switch to plain text by clicking Format in the menu bar and selecting Make Plain Text.

Copy the following code and paste it into your empty index.html file. This is the document structure and the first set of CSS styles:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>My First AWS Website</title>
    <style>
        /* Page-wide layout and colors */
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
            max-width: 800px;
            margin: 0 auto;
            padding: 40px 20px;
            background-color: #f0f4f8;
            color: #1a202c;
        }
        /* Main heading with a blue underline */
        h1 {
            color: #2b6cb0;
            border-bottom: 3px solid #2b6cb0;
            padding-bottom: 10px;
        }
        /* White card containers for each content section */
        .card {
            background: white;
            border-radius: 8px;
            padding: 24px;
            margin: 20px 0;
            box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
        }

What does this code do?

The DOCTYPE and meta tags set up a standard HTML5 page that works on all screen sizes.
The body styles center the content and add a light blue-grey background.
The .card class creates white rounded boxes with a subtle shadow for each section.

Directly below what you just pasted, add the remaining styles and close the <head> section:

        /* Blue-bordered highlight box for key takeaways */
        .highlight {
            background-color: #ebf8ff;
            border-left: 4px solid #2b6cb0;
            padding: 12px 16px;
            margin: 16px 0;
            border-radius: 0 4px 4px 0;
        }
        /* Centered footer text */
        footer {
            text-align: center;
            margin-top: 40px;
            color: #718096;
        }
    </style>
</head>

What does this code do?

The .highlight class creates a callout-style box with a blue left border for your learning summary.
The footer styles center the text at the bottom of the page.
The </style> and </head> tags close the styling section and the page head.

Save the file by pressing Cmd+S.
Open Finder, navigate to Desktop > my-aws-website, and double-click index.html to open it in your browser.

You should see a blank page, but the browser tab title reads My First AWS Website. That confirms the head section is working.

Switch back to your text editor. Below the </head> tag, paste the body of your website:

<body>
    <h1>My First AWS Website</h1>
    <!-- First card: introduction and learning highlights -->
    <div class="card">
        <h2>Hello from Amazon S3!</h2>
        <p>This website is hosted on Amazon S3 as a static website. I built it as part of my AWS Cloud Practitioner exam preparation.</p>
        <div class="highlight">
            <strong>What I learned building this:</strong>
            <ul>
                <li>How to create and secure an AWS account</li>
                <li>The difference between root users and IAM users</li>
                <li>How S3 stores objects in buckets</li>
                <li>How bucket policies control access</li>
                <li>The AWS shared responsibility model</li>
            </ul>
        </div>
    </div>
    <!-- Second card: AWS services summary -->
    <div class="card">
        <h2>AWS Services Used</h2>
        <p><strong>Amazon S3</strong> - Object storage service hosting this website</p>
        <p><strong>AWS IAM</strong> - Identity and Access Management for securing my account</p>
        <p><strong>AWS Budgets</strong> - Cost management to prevent surprise bills</p>
    </div>
    <footer>
        <p>Hosted on Amazon S3 | AWS Cloud Practitioner Prep</p>
    </footer>
</body>
</html>

What does this code do?

The first card introduces your site and lists what you learned building this project inside a highlight box.
The second card lists the three AWS services you used: S3, IAM, and Budgets.
The footer adds a tagline at the bottom of the page.

Save index.html by pressing Cmd+S.
Switch to the browser tab where you opened the file and refresh the page.

You should see your full website with a blue heading, two white cards, and a footer. The first card shows your learning highlights in a blue-bordered box.

Seeing raw HTML code instead of a styled page?

If you used TextEdit, make sure you switched to plain text mode before pasting. Rich text mode wraps the HTML in its own formatting, which breaks the file.

Also check that the file is saved with the .html extension, not .txt or .rtf. TextEdit may append its own extension when saving.

help me fix my index.html file that is showing raw code in the browser

✔️ Awesome, I've got everything!

Great. Make sure you saved index.html and that your browser shows the full styled page.

ⓧ I'd like to double check the full code

Your index.html file should contain all three code chunks you pasted, in this order:

Chunk 1: The <!DOCTYPE html> declaration, the <head> opening, meta tags, title, and CSS styles for body, h1, and .card.
Chunk 2: CSS styles for .highlight and footer, followed by </style> and </head>.
Chunk 3: The entire <body> with two cards, a highlight box, a footer, and the closing </html> tag.

Scroll up and confirm each chunk is present in your file, in order.

Now upload your file to the S3 bucket.

Switch back to the AWS Console in your browser.
In the S3 General purpose buckets list, click on your bucket name to open it.
Choose Upload.
Choose Add files.
Navigate to Desktop > my-aws-website, select index.html, and click Open.
Choose Upload at the bottom of the page.

You should see a green success banner and index.html listed as an object in your bucket.

What is an S3 object?

In S3, every file you upload becomes an object. Each object has three parts: a key (the file name, like index.html), a value (the file content), and metadata (information about the file like its size and type).

Upload button greyed out?

Make sure you used Add files to select your file before clicking Upload. The file should appear in the upload list before you can submit.

help me upload a file to my S3 bucket

Try to access your file

Your website file is now stored in S3. The question is: can anyone on the internet actually see it?

In your bucket, click on the index.html file name to open its details page.
Find the Object URL field in the object overview. This is the direct URL to your file on the internet.

Before you click that URL, take a guess. Do you think your website will load, or will something else happen?

Click the Object URL to open it in a new browser tab.

You see an AccessDenied XML error message instead of your website. This is not a mistake.

Why did I get AccessDenied?

S3 blocks all public access by default. When you created your bucket, Block all public access was checked. This means nobody outside your AWS account can view objects in the bucket, even if they have the URL.

This is the shared responsibility model in action. AWS provides the security controls and turns them on by default. You, the customer, decide what to open and when. In the next step, you will deliberately open access so your website is visible to the world.

Your website is uploaded and waiting in S3, but it is locked behind the default security wall. Next up, you will enable static website hosting, open the permissions, and make your site live on the internet.

Enable Static Website Hosting and Fix Permissions

In the previous step, you uploaded your website files to S3 and tried to visit the Object URL. You got an AccessDenied error because S3 blocks public access by default.

This is the shared responsibility model in action. AWS provides the security controls (like Block Public Access), but you decide what to open and when. In this step, you will turn on static website hosting and fix the permissions so that anyone can visit your site.

In this step, get ready to:

Enable static website hosting on your S3 bucket.
Disable Block Public Access and add a bucket policy.
Visit your live website on the internet.

Enable static website hosting

Your index.html file is sitting in the bucket, but S3 does not know it should serve that file as a webpage. You need to turn on static website hosting and tell S3 which file is your homepage.

Switch back to the S3 console tab in your browser.
Click on your bucket name to open it (if you are not already inside it).
Choose the Properties tab.
Scroll down to Static website hosting and choose Edit.
Select Use this bucket to host a website.
Under Static website hosting, choose Enable.
In the Index document field, enter index.html.
Choose Save changes.

After saving, you will see a Bucket website endpoint URL under Static website hosting on the Properties tab.

Scroll down to Static website hosting and find the Endpoint URL. It looks something like http://my-first-website-yourname-2026.s3-website-us-east-1.amazonaws.com.
Copy this URL and save it somewhere handy. You will use it to test your website.

What is a bucket website endpoint?

This endpoint is a special URL that S3 creates when you enable static website hosting. Unlike the Object URL you tried in the previous step, this endpoint knows how to serve index.html as the default homepage when someone visits the root URL.

S3 website endpoints do not support HTTPS. Your site will load over HTTP for now. The Secret Mission later uses CloudFront to add HTTPS.

Before you open this URL, what do you think will happen? Will your website load successfully, or will you see another error?

Open the bucket website endpoint URL in a new browser tab.

You see a 403 Forbidden error. The hosting is enabled, but Block Public Access is still preventing anyone from viewing your files.

What is the shared responsibility model?

AWS secures the physical infrastructure and provides security tools like Block Public Access and IAM. You, the customer, are responsible for configuring those tools correctly.

Right now you are seeing that responsibility in action. AWS gave you Block Public Access turned on by default. You need to intentionally disable it and write a bucket policy that grants public read access. Security and Compliance is 30% of the CLF-C02 exam, so understanding this distinction is critical.

Disable Block Public Access and add a bucket policy

You need to do two things to let the world see your website. First, disable Block Public Access so that S3 allows public policies on this bucket. Second, add a bucket policy that explicitly grants read access to everyone.

In your bucket, choose the Permissions tab.
Under Block public access (bucket settings), choose Edit.
Uncheck Block all public access.
Choose Save changes.
A confirmation dialog appears. Type confirm in the text field and choose Confirm.

Why does AWS ask you to type confirm?

Disabling Block Public Access means anyone on the internet could potentially access objects in your bucket. AWS requires you to type confirm to make sure this is an intentional decision, not an accidental click.

Now you need to add a bucket policy that tells S3 exactly who can do what with your files.

Still on the Permissions tab, scroll down to Bucket policy and choose Edit.
Paste the following bucket policy into the Bucket policy editor:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::[[BUCKET_NAME="your-bucket-name"]]/*"
            ]
        }
    ]
}

What does this bucket policy do?

"Principal": "*" means anyone in the world.
"Action": ["s3:GetObject"] means they can only read (download) objects. They cannot upload, delete, or modify anything.
"Resource" points to every object inside your bucket (the /* at the end means all files).
This is a resource-based policy because it is attached to the S3 bucket itself, not to a user or role. The exam will ask you to distinguish resource-based policies from identity-based policies (which are attached to IAM users or roles).

Replace your-bucket-name with your actual bucket name (for example, my-first-website-yourname-2026).
Choose Save changes.

Seeing a Policy has invalid resource error?

Double-check that the bucket name in the Resource line matches your actual bucket name exactly. Bucket names are case-sensitive.
Make sure you kept the /* at the end of the ARN. Without it, the policy does not apply to the objects inside the bucket.
If you cannot save the policy at all, go back to Block public access (bucket settings) and confirm that Block all public access is unchecked.

Why can't I save my bucket policy?

Visit your live website

You have enabled hosting and fixed the permissions. Before you open the URL again, what do you expect to see this time?

Open the bucket website endpoint URL you copied earlier in a new browser tab. You can find it again on the Properties tab under Static website hosting.

Your website is live on the internet. You should see your heading, your card sections, and the list of AWS services you used. Anyone with this URL can visit your site right now.

Still seeing a 403 error?

Make sure you are visiting the bucket website endpoint (starts with http:// and contains s3-website), not the Object URL from the previous step.
Confirm that Block all public access is unchecked on the Permissions tab.
Check that the bucket policy is saved and the bucket name in the Resource ARN matches your actual bucket name.
Try a hard refresh in your browser (Cmd+Shift+R on macOS or Ctrl+Shift+R on Windows) to clear any cached error page.

Why is my S3 static website still showing a 403 error?

Your website is live. Next up, you will review everything you built through the lens of the CLF-C02 exam so these concepts stick when it matters most.

Explore What You Built Through the Lens of the Exam

Your website is live on the internet and anyone with the URL can visit it. You have a secured AWS account, a dedicated admin user, and a cost budget watching your back.

The CLF-C02 exam tests whether you understand why each AWS service exists and how they connect to each other. In this step, you will revisit IAM, Amazon S3, and AWS Budgets and map what you built to the four exam domains.

In this step, get ready to:

Review the security concepts you applied and connect them to exam Domain 2 (Security and Compliance, 30% of the exam).
Review the cloud technology and services you used and connect them to exam Domain 3 (Cloud Technology and Services, 34% of the exam).
Review billing and cost management concepts and connect them to exam Domain 4 (Billing, Pricing, and Support, 12% of the exam).

Review the security concepts you applied

Security and Compliance is Domain 2 of the CLF-C02 exam. It accounts for 30% of the scored content.

In the Console search bar, type IAM and open the IAM service.
In the left navigation pane, choose Users.
Confirm you see admin-user listed with the AdministratorAccess policy attached.

You are currently signed in as this IAM user, not the root user. The root user has MFA enabled, and you created a separate admin user for daily work.

What is the principle of least privilege?

The root user has unlimited power over your entire AWS account. Using it for everyday tasks is a security risk because anyone who compromises those credentials owns everything.

The principle of least privilege means giving each user only the permissions they need to do their job. Your setup follows this pattern: root is locked down with MFA and only used for account-level tasks, while a dedicated IAM user handles daily work. The exam tests this concept heavily.

Switch to the S3 service by searching for S3 in the Console search bar.
Click on your bucket name to open it.
Choose the Permissions tab and scroll down to Bucket policy.
Confirm the JSON policy you added in Step 4 is still there, with PublicReadGetObject granting s3:GetObject access to Principal: "*".

What is the difference between identity-based and resource-based policies?

The AdministratorAccess policy attached to your admin-user is an identity-based policy. It is attached to a user and defines what that user can do.

The bucket policy you are looking at is a resource-based policy. It is attached to the S3 bucket itself and defines who can access it. The exam will ask you to distinguish between these two types.

These two policy types work together. Your bucket policy opens the front door for public visitors, while your IAM policy gives admin-user full management access. Understanding who controls what leads to the next key concept.

What is the shared responsibility model?

AWS secures the physical infrastructure (data centers, hardware, networking) and provides security tools like Block Public Access and IAM. You, the customer, are responsible for configuring those tools correctly.

Think about what you did in this project. AWS provided S3 with Block Public Access turned on by default. You decided to disable it and write a bucket policy that opens access. Enabling MFA, writing proper policies, and managing who has access are all your responsibility.

The shared responsibility model shifts depending on the service. For S3, you manage data and access policies. For a fully managed service like Lambda, AWS takes on more of the operational responsibility. The exam tests this distinction across different services.

Review the cloud technology and services you used

Cloud Technology and Services is Domain 3 of the CLF-C02 exam. It accounts for 34% of the scored content, making it the largest domain.

You have been using the AWS Management Console throughout this project. The Console is one of several ways to interact with AWS services. The exam tests your knowledge of all the access methods: the Console, the CLI, SDKs, and APIs.

Return to your S3 bucket by searching for S3 in the Console search bar (if you navigated away).
Click on your bucket name to open it.
In the Objects tab, confirm you see index.html listed.

What is S3 and how does it store data?

Amazon S3 is an object storage service. Objects are stored in buckets. Each object has three parts: a key (the file name, like index.html), a value (the file content itself), and metadata (information about the object like size and content type).

The exam expects you to know that S3 is object storage (not block storage or file storage) and that data is organized into buckets with globally unique names.

Choose the Properties tab in your bucket.
Look at the AWS Region displayed near the top of the page. Note which Region your bucket lives in.
Scroll down to Static website hosting and look at the Bucket website endpoint URL. Notice that the Region name appears in the URL itself.

What are Regions, Availability Zones, and edge locations?

Your bucket lives in a specific AWS Region. Regions are geographic areas (like US East or Europe West) that each contain multiple Availability Zones. Each Availability Zone is an isolated data center with its own power and networking. This is the AWS global infrastructure.

Your S3 website endpoint is Region-specific, meaning visitors far from that Region may experience slower load times. CloudFront (which you can set up in the Secret Mission) is a CDN that caches your content at edge locations worldwide, making your site faster and adding HTTPS support.

Review billing and cost management

Billing, Pricing, and Support is Domain 4 of the CLF-C02 exam. It accounts for 12% of the scored content.

Search for Budgets in the Console search bar and open AWS Budgets.
Confirm your monthly cost budget is listed with a $1.00 budgeted amount and your email address set for alerts.

This budget emails you if your spending approaches $1. It is a real-world cost management practice that AWS professionals use on production accounts.

What billing concepts does the exam test?

Your account is on the Free Plan with up to $200 in credits. S3 storage under the Always Free tier allows usage within monthly limits at no cost. The budget you created is your safety net if costs ever appear.

The exam will ask about AWS Budgets and Cost Explorer (a tool for visualising past spending). It also covers pricing models: On-Demand (pay as you go), Reserved Instances (commit for 1-3 years at a discount), Spot Instances (bid on unused capacity at steep discounts), and Savings Plans (flexible commitment-based discounts).

Confirm everything is in place

You have now reviewed all three core services through the lens of the exam. Take a moment to confirm everything is exactly where you left it.

Confirm you are signed in as your IAM user (admin-user), not the root user. Your account name in the top-right corner should show the IAM user name.
Navigate to IAM and confirm your admin-user is listed under Users.
Navigate to S3 and confirm your bucket contains index.html and has static website hosting enabled.
Navigate to AWS Budgets and confirm your $1.00 monthly cost budget is listed with your email set for alerts.

Something missing?

If your IAM user is not listed, you may have accidentally deleted it. Return to Step 2 and re-create the user with the AdministratorAccess policy.

If your S3 bucket is missing or the website is not loading, revisit Step 3 (bucket creation and upload) and Step 4 (hosting and permissions).

Need help figuring out what went wrong?

Secret mission

Add CloudFront for HTTPS and Global Distribution

Your S3 website is live, but it only serves over HTTP from a single AWS Region. In this secret mission, you will add Amazon CloudFront to serve your site over HTTPS from edge locations around the world. This covers two more exam domains and adds a real CDN to your project.

Clean Up Your Resources

This project runs on the AWS Free Plan, so your resources will not incur charges unless you upgrade to a Paid plan. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

S3 bucket (e.g., my-first-website-yourname-2026) with your uploaded website files (Always Free tier within monthly limits, no ongoing cost).
IAM admin user (admin-user) with AdministratorAccess policy (no cost).
CloudFront distribution (Secret Mission only, Always Free tier includes 1 TB data transfer out and 10 million HTTP/HTTPS requests per month).
AWS Budget ($1 monthly cost budget, no cost).

Keep everything running

No action needed. Choose this if you want to keep your website live and continue exploring AWS.

Your S3 bucket hosts a single HTML file, which is well within the Always Free tier limits at no cost.
If you completed the Secret Mission, your CloudFront distribution is also within the Always Free tier (1 TB data transfer out and 10 million requests per month).
Your AWS Budget continues monitoring your spending at no cost.
Your IAM admin user has no cost associated with it.

Pause - I'll come back to this later

There is nothing to pause in this project. S3 and CloudFront charge based on storage and requests, not uptime. A single HTML file generates negligible usage within the Always Free tier.

Your website will remain live at no cost while you are on the Free Plan.
If you want to fully remove your resources, follow the instructions in the Delete tab instead.

Delete - I don't want to use this again

Remove all project resources and start fresh. Follow these steps in order.

If you completed the Secret Mission, delete the CloudFront distribution first:

Search for "CloudFront" in the Console search bar and open the CloudFront service.
Select your distribution by clicking the radio button next to it.
Choose Disable to stop the distribution from serving content.
Wait for the status to change from "Deploying" to "Disabled." This can take several minutes.
Select your distribution again and choose Delete.

Empty and delete the S3 bucket:

Search for "S3" in the Console search bar and open the Amazon S3 service.
Select your bucket by clicking the radio button next to it (do not click the bucket name).
Choose Empty to remove all objects from the bucket.
Type permanently delete in the confirmation field and choose Empty.
After the bucket is emptied, select it again by clicking the radio button.
Choose Delete.
Type your bucket name in the confirmation field and choose Delete bucket.

Delete the IAM admin user:

Search for "IAM" in the Console search bar and open the IAM service.
In the left navigation pane, choose Users.
Select admin-user by clicking the radio button next to it.
Choose Delete.
Type the user name in the confirmation field and confirm the deletion.

Delete the AWS Budget:

Search for "Budgets" in the Console search bar and open AWS Budgets.
Select your monthly cost budget.
Choose Actions, then choose Delete.

Delete the local project files:

On your Mac, open Finder and navigate to the folder where you created your index.html file.
Drag the folder to the Trash and empty the Trash.

Nice Work!

Nice work! You just went from zero AWS experience to a live website on the internet, secured by real-world IAM best practices and protected by a cost budget.

You've learned how to:

Secured an AWS account with MFA on the root user and created a dedicated IAM admin user with AdministratorAccess, following the principle of least privilege by never using root for daily tasks.
Created an S3 bucket, experienced the 403 AccessDenied error firsthand, then fixed permissions with a bucket policy and enabled static website hosting to make your site live on the internet.
Set up a cost budget in AWS Budgets to prevent surprise bills and reviewed how every service you used maps to the four CLF-C02 exam domains.
Secret Mission: Added a CloudFront distribution for HTTPS and global content delivery from edge locations worldwide.

Ready to quiz yourself?