Harden AWS Account Guardrails

Secure root access, create an MFA admin, and set AWS cost guardrails.

Introduction

30 Second Summary

A forgotten online resource can keep running after a practice project ends. One overlooked setting can also leave the whole account easier to misuse.

In this project, you will replace routine use of the AWS account root user with an MFA-protected IAM administrator. You will add cost guardrails that surface risky spending before future practice projects get away from you.

What You'll Build

Picture beginning your next learning project from learning-admin while the AWS Management Console shows your credits plus the guardrails waiting to catch unexpected spend.

By the end of this project, you'll have:

A protected everyday sign-in as learning-admin, confirmed through MFA. You can leave the root user locked away during routine console work.
A billing snapshot that shows your current credit balance, expiration information, plus Free Tier usage. Email alerts add a warning when tracked usage crosses 85 percent of a Free Tier limit.
A cost guardrail routine with Learning-Zero-Spend plus Learning-Monthly-5-USD visible in AWS Budgets. AWS Cost Anomaly Detection adds a view of unusual spend settings. The saved aws-project-safety-checklist.txt makes the review repeatable.
Secret Mission: Tune the Cost Anomaly Detection email subscription to use a learner-sized $1 absolute threshold.

Are there any prerequisites?

The required setup includes a Windows computer plus a smartphone. Your standalone AWS account must come from the advanced sign-up experience and still have access to its root email, primary contact phone, plus existing root MFA device.

Before We Start

Before you change your AWS learning account, take a moment to commit to what you are protecting. This goal keeps root credentials secure while helping you catch forgotten billable resources.

Secure the Root Account Foundation

Your AWS account's root user can recover the account. It can also override account controls.

This step tests the existing multi-factor authentication (MFA) path in the AWS Management Console.

You'll confirm the root recovery channels. You'll also complete one required billing delegation before locking the root identity away.

In this step, get ready to:

Test the existing root MFA sign-in.
Confirm the current root recovery contact information.
Activate billing access for future AWS Identity and Access Management (IAM) identities.

Test root sign-in and MFA

Successful sign-in proves the root password still works. It also proves the existing MFA device can complete the sign-in path.

Using root can feel high stakes. This session stays limited to the account-level checks in this step.

Go to the AWS Management Console in your browser.
Select Root user as the sign-in identity.
Enter the root email address.
Complete the password prompt.
Approve the MFA prompt with the existing root MFA device.
Confirm the console shows the root identity as active.

That is an important check complete. Your existing root MFA device can still unlock the account when it is genuinely needed.

Root sign-in not working?

Confirm you selected Root user before entering the root email address.
Retry the MFA approval with the existing root MFA device.

Help me troubleshoot my AWS root sign-in without exposing my credentials.

Confirm the recovery contact information

AWS can use the root email during account recovery. The primary contact phone provides the other recovery channel.

The contact section sits inside the account settings, so its location can be easy to miss.

Open the root email inbox in a separate browser tab.
Confirm the inbox loads successfully.
Return to the AWS Management Console tab.
Choose the account name in the console header.
Choose Account.
Find Contact information.
Compare the listed root email with the accessible inbox.
Compare the listed primary phone with the number that can receive recovery messages.

Leave the contact section unchanged if both values are current.
Choose Edit if either value is stale.
Replace each stale contact detail with its current value.
Choose Update to save any changes.

You have now tied account recovery to contact methods you control. That protects the path back into the account if the root MFA device becomes unavailable.

Why recovery details matter

Recovery after losing every root MFA device depends on an accessible root email. It also depends on a current account phone number.

Activate IAM billing access

IAM identities cannot access Billing and Cost Management by default. The root user must activate billing delegation once.

This setting creates the foundation for checking credits through an everyday administrative identity later.

Keep root access keys absent

Root access keys are long-term programmatic credentials. This project uses console access only, so the root identity stays free of access keys.

Stay on the Account page from the previous check.
Find IAM User and Role Access to Billing Information.
Choose Edit.
Select Activate IAM Access.

Before you save the setting, what confirmation do you expect the Account page to show?

Choose Update to activate billing delegation.

You should see IAM user/role access to billing information is activated on the Account page.

Confirm that no root access keys exist.

That closes the root-only setup. Future IAM identities can receive billing permissions without using root for routine work.

Foundation checkpoint

The existing root MFA device successfully opened the account.
The existing root MFA device remains enabled.
The root email inbox is accessible.
The primary contact phone can receive AWS recovery messages.
The account contact information is current.
No root access keys exist.
IAM User and Role Access to Billing Information is activated for the standalone AWS account.

Your root account is recovery-ready. Next, you'll create an MFA-protected IAM administrator for everyday console work.

Create Everyday Administrative Access

Your root session in the AWS Management Console confirmed that the recovery path works. IAM billing access is active.

Routine root use exposes the account's most powerful credential during everyday work. You'll create a console-only administrator with its own MFA token.

In this step, get ready to:

Create the console-only learning-admin user.
Grant AdministratorAccess through LearningAccountAdmins.
Protect learning-admin with MFA before completing its first sign-in.

Create the console-only administrator

Console-only access gives learning-admin a password for browser sign-in. The identity does not need programmatic access keys.

In the AWS Management Console from the previous step, enter IAM in the top search bar.
Select IAM from the search results.
Choose Users in the navigation pane.
Choose Create user.
Enter learning-admin in User name.
Select Provide user access to the AWS Management Console - optional.
Choose I want to create an IAM user.

Why console access only?

This identity is for signing in to the AWS console. Leaving access keys uncreated removes a programmatic credential that this workflow does not need.

Keep the autogenerated option under Console password.
Select User must create a new password at next sign-in (recommended).
Continue to Set permissions.
Choose Add user to group.
Choose Create group.
Enter LearningAccountAdmins in User group name.
Select the AWS managed policy AdministratorAccess.
Choose Create group.

Why use an IAM group?

The group holds the administrative policy for learning-admin. This keeps permission management attached to one named group.

The AdministratorAccess policy provides broad access for the account's sole administrator. Future projects can introduce narrower roles for individual workloads.

Select LearningAccountAdmins for the new user.
Continue to Review and create.
Confirm the summary lists learning-admin as the user.
Choose Create user.

You should see confirmation that learning-admin was created with membership in LearningAccountAdmins.

The generated password is sensitive. Your password manager gives it a safe temporary home.

Store the autogenerated password in your password manager.
Record the account ID from the account sign-in information: your 12-digit AWS account ID.
Leave access keys uncreated for learning-admin.

Unable to create the user?

Check that learning-admin appears in User name.
Confirm that LearningAccountAdmins is selected before returning to the review page.
Clear the policy search if AdministratorAccess does not appear in the list.

Help me fix the IAM user or group setup.

Assign a separate MFA token

The existing authenticator app can hold a separate token for learning-admin. The root MFA token remains enabled as its own recovery safeguard.

Return to Users in the IAM console.
Choose learning-admin from the user list.
Choose Security Credentials.
Under Multi-factor authentication (MFA), choose Assign MFA device.
Enter learning-admin as the device name.
Choose Authenticator app.

Why a separate token?

Each identity needs its own MFA registration. A single supported authenticator app can store multiple virtual devices as separate entries.

The new entry protects learning-admin without replacing the existing root token.

Add a new account in the authenticator app on your existing MFA device.
Follow the on-screen pairing method to register the displayed virtual device.
Enter the first current code in MFA code 1.
Enter the next consecutive code in MFA code 2.
Choose Add MFA.

You should see the MFA device listed under Multi-factor authentication (MFA) for learning-admin.

MFA codes not accepted?

Confirm that you entered codes from the new learning-admin token.
Enter two consecutive codes in the order shown by the authenticator app.
Check that your smartphone uses automatic date settings if the codes keep being rejected.

Help me troubleshoot the IAM MFA registration.

Sign in as learning-admin

The separate identity now has administrative permissions plus its own MFA token. The first sign-in replaces the autogenerated password with a permanent one.

Open the account menu in the current root session.
Choose Sign out.
Visit https://console.aws.amazon.com/ in your browser.
Enter your 12-digit AWS account ID when prompted.
Enter learning-admin as the IAM user name.
Enter the autogenerated password from your password manager.
Set a permanent console password when AWS prompts you.

Before you enter the MFA code, predict which identity will appear in the console header.

Enter the current MFA code from the learning-admin token to finish signing in.

You should see Console Home with learning-admin shown as the active identity.

That's the daily sign-in path working. Your root identity can stay reserved for account-level tasks.

Unable to sign in?

Confirm that the account ID matches the standalone AWS account where you created learning-admin.
Use the autogenerated password only until AWS asks you to set the permanent password.
Choose the learning-admin token in your authenticator app before entering the MFA code.

Help me troubleshoot the first IAM user sign-in.

Your everyday administrative identity is ready without IAM access keys. Next, you'll use its delegated billing access to inspect credits plus Free Tier protection.

Check Credits and Enable Free Tier Alerts

Your IAM user learning-admin now gives you an MFA-protected everyday session. The next risk is starting a learning project without knowing how much credit runway remains.

AWS Billing and Cost Management shows your account baseline. You will also test whether the built-in Free Tier email can cover the account-wide spending warning you need.

In this step, get ready to:

Review your account plan and credit position.
Enable Free Tier usage emails for a monitored address.
Save a reusable pre-project checklist in Windows Notepad.

Review your credits and Free Tier usage

Your plan status shows how long your current credits can support future learning. The Free Tier view shows whether eligible service usage is already approaching a limit.

Use the search bar at the top of the AWS Management Console to search for Billing and Cost Management.
Select Billing and Cost Management from the search results.
Review the account plan shown on the billing home page.

Where should I look?

Account layouts vary with the plan type. Use the billing home page for the current plan status.

Use Credits when that page is available for your balance or expiration details. Use Free Tier for current eligible usage.

Record the account plan type here: your account plan type.
Choose Credits in the navigation pane if it is available for your account.
Record the current credit balance here: your current credit balance.
Record the expiration information here: your credit expiration date or days remaining.
Choose Free Tier in the navigation pane to review current usage.
Record the usage position here: your Free Tier usage observations.

You now have a concrete baseline for the account before any learning workload begins. That baseline shows how much credit runway remains.

Enable Free Tier email alerts

Billing preferences control whether AWS sends Free Tier usage emails to a monitored address. Enabling the preference gives you a warning path outside the console.

Choose Billing preferences in the navigation pane.
Choose Edit under Alert preferences.
Select Receive AWS Free Tier alerts.
Enter your monitored email address as the monitored email recipient.

Before you save this preference, do you think one Free Tier email can warn you about every possible dollar of AWS spend?

Choose Update to save the alert preference.

You should see Receive AWS Free Tier alerts selected with your monitored email address. Your learning account now has an early service-usage warning.

What Gap Did This Reveal?

AWS sends these emails when tracked service-level Free Tier usage exceeds 85 percent of a limit. Each warning covers an eligible service limit.

The alert has no account-wide dollar threshold. This is the intended gap you have now exposed.

Alert Preference Not Staying Enabled?

Reopen Alert preferences if the selection does not stay enabled.
Confirm that your monitored email address appears in the preference.
Choose Update again after confirming the address.

Help me troubleshoot why my Free Tier alert preference is not staying enabled.

Save your pre-project safety checklist

A local checklist turns today’s billing review into a repeatable habit. Windows Notepad keeps that routine available before every future AWS project.

Press the Windows key to open the search bar.
Type Notepad into the search bar.
Press Enter to open Windows Notepad.
Type AWS project safety checklist on the first line.
Add the account details listed below on separate lines:

Account Details to Include

Plan type: your account plan type.
Current credit balance: your current credit balance.
Credit expiration date or days remaining: your credit expiration date or days remaining.
Free Tier usage observations: your Free Tier usage observations.

Type Pre-project check: below the account details.
Add each check from the reference below on a separate line:

Pre-Project Checks to Include

Review credits and expiry.
Review Free Tier usage.
Review both budgets.
Review Cost Anomaly Detection.
Record the AWS Regions the next project will use.

Click File in the Notepad menu bar.
Click Save As.
Select Documents as the save location.
Enter aws-project-safety-checklist.txt in the File name field.
Confirm the save.

Before the final check, which saved setting and local file should prove this step worked?

Switch back to the AWS Management Console.
Choose Billing preferences in the navigation pane.
Confirm that Receive AWS Free Tier alerts is selected with your monitored email address.
Return to Windows Notepad.
Review the completed Documents\aws-project-safety-checklist.txt file.

In Billing preferences, you should see the enabled Free Tier alert with your monitored address. In Notepad, you should see your account details followed by all five pre-project checks.

✔️ My checklist matches

Your checklist now captures the account’s current plan position. It also gives every future AWS project the same pre-project review.

ⓧ I'd like to double check the full checklist

The completed Documents\aws-project-safety-checklist.txt file contains these details and checks.

Plan type: your account plan type.
Current credit balance: your current credit balance.
Credit expiration date or days remaining: your credit expiration date or days remaining.
Free Tier usage observations: your Free Tier usage observations.
Pre-project check: review credits and expiry.
Pre-project check: review Free Tier usage.
Pre-project check: review both budgets.
Pre-project check: review Cost Anomaly Detection.
Pre-project check: record the AWS Regions the next project will use.

Your credit baseline is recorded. Next, you will inspect anomaly monitoring to learn how quickly it can detect unusual spending.

Inspect Cost Anomaly Detection

Your Free Tier alerts are active. Your checklist holds the account's current credit position.

AWS Cost Anomaly Detection adds another layer by looking for unusual spending patterns. Its automatic email criteria can be large compared with learner-sized spend.

Billing delays can slow notifications. History requirements can postpone coverage for new usage.

In this step, get ready to:

Inspect whether an AWS Services monitor exists.
Review the available alert subscription details.
Record the anomaly-detection timing limits in your checklist.

Inspect the cost monitor state

A cost monitor defines the spending activity that anomaly detection watches. Eligible newer standalone accounts may already have an automatically created monitor.

Your existing checklist in Windows Notepad captures the state that belongs to your account.

Return to the Billing and Cost Management console from earlier.
Choose Cost Anomaly Detection in the navigation pane.
Choose the Cost monitors tab.
Check whether an AWS Services monitor is listed.
Choose the tab below that matches your account.

✔️ AWS Services is listed

The account has a monitor available for review. Capture its exact name before moving to the subscription.

Press the Windows key to open Windows Search.
Type Notepad into Windows Search.
Press Enter to open Notepad.
Use Notepad's file menu to open Documents\aws-project-safety-checklist.txt.
Record the monitor name exactly as shown in the console.
Save the checklist.

You should now see the monitor name beside your Cost Anomaly Detection check.

ⓧ No monitor is listed

Some existing accounts legitimately have no monitor. Your checklist needs to preserve that account-specific result.

Press the Windows key to open Windows Search.
Type Notepad into Windows Search.
Press Enter to open Notepad.
Use Notepad's file menu to open Documents\aws-project-safety-checklist.txt.
Add Cost Anomaly Detection not configured to the checklist.
Save the checklist.

You should now see the missing monitor documented without any guessed configuration values.

Can't See the Anomaly Views?

Confirm that learning-admin is still shown as the active console identity.
Return to Billing and Cost Management from the current console session.
Confirm that IAM billing access remains activated for the account.

Help me find Cost Anomaly Detection in my AWS learning account.

Review the alert subscription

An alert subscription controls who receives anomaly notifications. It also defines the delivery frequency plus the thresholds that trigger an email.

Choose the tab that matches the monitor state you found.

✔️ A subscription is attached

Return to Cost Anomaly Detection in the AWS console.
Choose the Alert subscriptions tab.
Find the subscription attached to the AWS Services monitor.
Switch back to Documents\aws-project-safety-checklist.txt in Notepad.
Record the subscription frequency shown in the console.
Record the subscription recipient shown in the console.

You should now see the delivery frequency plus the recipient in your checklist.

Record the absolute threshold shown in the console.
Record the percentage threshold shown in the console.
Save the checklist.

You should now see every available notification condition recorded for the subscription.

ⓧ The monitor has no subscription

A monitor without an attached subscription has no delivery values to record. Preserve that distinction in your checklist.

Return to Cost Anomaly Detection in the AWS console.
Choose the Alert subscriptions tab.
Confirm that no subscription is attached to the AWS Services monitor.
Switch back to Documents\aws-project-safety-checklist.txt in Notepad.
Record that the AWS Services monitor has no attached alert subscription.
Save the checklist.

Your checklist should now distinguish the existing monitor from the missing subscription.

ⓧ No monitor exists

There is no attached subscription to inspect without a monitor. The absence entry from the previous check is the correct account record.

Confirm that the checklist contains Cost Anomaly Detection not configured.

Why the Default Threshold Is Too Large

The automatic configuration sends a daily email to the root email address.

A notification requires spending to be more than 40 percent above expected. It also requires a minimum $100 impact.

Those criteria can withhold emails for anomalies that still matter in a low-spend learning account.

Record the timing limits

Anomaly alerts depend on processed billing data. They also depend on enough historical usage to establish an expected pattern.

Switch back to Documents\aws-project-safety-checklist.txt in Notepad.
Add that billing data can be delayed by up to 24 hours.
Add that a new monitor can take 24 hours to begin detecting anomalies.

You should now see two separate 24-hour timing limits in the checklist.

Add that anomaly detection for new usage requires at least 10 days of historical usage data.
Save Documents\aws-project-safety-checklist.txt.

Before you compare the console with your notes, do you expect every available monitor value to match your checklist?

Return to Cost Anomaly Detection in Billing and Cost Management.
Choose the Cost monitors tab.
Compare the monitor state with your checklist.
Choose the Alert subscriptions tab if an AWS Services monitor exists.
Compare every available subscription value with your checklist.
Switch back to the checklist in Notepad.
Confirm that all three timing limits are recorded.

If a monitor exists, its name should match your checklist. Every available subscription value should also match.

If no monitor exists, you should see no AWS Services monitor in the console. Your checklist should contain Cost Anomaly Detection not configured.

Do the Values Differ?

Check that you copied values from the subscription attached to the AWS Services monitor.
Check that the frequency plus both threshold fields came from the same subscription.
Save the checklist after correcting any mismatched value.

Help me compare my Cost Anomaly Detection notes with the AWS console.

You documented the anomaly settings that actually exist in your account. Next, you'll add fixed-dollar budgets to cover the gap left by delayed anomaly notifications.

Add Budgets and a Cleanup Routine

Your review of AWS Cost Anomaly Detection showed that anomaly alerts can arrive too late for a small learning account. The default threshold can also sit far above learner-sized spending.

AWS Free Tier alerts track service-level limits. They do not provide a fixed dollar ceiling.

In this step, AWS Budgets adds two direct email guardrails. Your checklist turns cleanup into a repeatable routine.

In this step, get ready to:

Create a zero-spend email budget.
Create a $5 monthly cost email budget.
Extend your Windows Notepad checklist with a cleanup loop.

Create the zero-spend budget

Budget setup can feel like the point where charges begin. Standard AWS Budgets monitoring and notifications are free of charge.

The Zero spend budget template emails your monitored address after spending exceeds AWS Free Tier limits.

Switch back to the Billing and Cost Management console from earlier.
Choose Budgets in the navigation pane.

You should see the Budgets page for your account.

Choose Create budget.
Choose Use a template (simplified).

You should see the available budget templates.

Choose Zero spend budget.
Enter Learning-Zero-Spend as the budget name.

The form should now show the zero-spend template with your budget name.

Enter the monitored email recipient from your Free Tier alerts.

The form should now show the address that receives your account alerts.

Continue without configuring a budget action.
Choose Create budget.

You should see Learning-Zero-Spend on the Budgets page. Your first fixed-dollar guardrail is now active.

Budget Not Showing?

Confirm that you selected Use a template (simplified) during budget creation.
Refresh the Budgets page.

Help me find my missing AWS budget.

Create the monthly cost budget

A monthly cost budget watches a dollar amount you choose. The Monthly cost budget template checks current spend plus forecasted spend against that amount.

This project uses the template only. This flow does not create a paid budget report.

Choose Create budget from the Budgets page.
Choose Use a template (simplified).

You should see the template choices again.

Choose Monthly cost budget.
Enter Learning-Monthly-5-USD as the budget name.

The form should now show the monthly template with your second budget name.

Set the monthly amount to $5.
Enter the monitored email recipient.

The form should show a monthly amount of $5 with your monitored email address.

Continue without configuring a budget action.
Choose Create budget.

You should see Learning-Zero-Spend plus Learning-Monthly-5-USD on the Budgets page. You now have email guardrails for any spend plus a learner-sized monthly amount.

Budgets Do Not Stop Spending

These budgets send email notifications. They do not stop resources.

Usage can continue while AWS processes billing data. Alerts can arrive after spending has crossed a threshold.

Add the cleanup loop

Budgets help you notice spending after billing data arrives. A cleanup loop reduces the chance that forgotten resources keep running.

AWS Regions can hold resources independently. Your checklist records every Region so each project ends with a complete review.

Return to Documents\aws-project-safety-checklist.txt in Windows Notepad from earlier.
Add Cleanup loop: below the existing anomaly timing notes.

You should see the new cleanup heading beneath the existing checklist details.

Add List every service and Region used.
Add Delete or stop project resources as required.

You should see the first two cleanup checks beneath the new heading.

Add Revisit service consoles in every recorded Region.
Add Check Bills and Budgets.

The cleanup loop now covers regional console reviews. It also includes a billing check.

Add Repeat the billing review the next day because cost data and notifications can be delayed.
Press Ctrl+S to save Documents\aws-project-safety-checklist.txt.

The last line should remind you to return after delayed billing information has had time to arrive.

Before you check the finished setup, which two budget names do you expect to see on the Budgets page?

Switch back to Billing and Cost Management from earlier.
Choose Budgets in the navigation pane.

You should see Learning-Zero-Spend plus Learning-Monthly-5-USD on the Budgets page.

Before you return to the checklist, which two review sections should it now contain?

Return to Documents\aws-project-safety-checklist.txt in Windows Notepad.

You should see the pre-project check plus the cleanup loop. The cleanup loop should finish with a next-day billing review.

Missing a Budget or Checklist Line?

Refresh the Budgets page if either budget name is missing.
Reopen Documents\aws-project-safety-checklist.txt from your Documents folder if the cleanup loop is missing.

Help me verify my AWS budgets and cleanup checklist.

That closes the fixed-dollar alert gap you found earlier. Your account now has two budget notifications plus a repeatable cleanup review.

Secret mission

Tune Anomaly Alerts for Learner-Sized Spend

The automatic $100 anomaly email threshold sits far above a $5 learning budget. If an AWS Services monitor is available, tune its daily email subscription to a $1 absolute threshold. Record the final guardrail in your Windows checklist.

Clean Up Your Resources

Choose how much of your AWS account-safety setup to keep. These safeguards create no billable workloads. Their ongoing cost is $0.

Resources you used:

An IAM user named learning-admin with its assigned MFA association.
An IAM user group named LearningAccountAdmins.
An AWS Budgets configuration named Learning-Zero-Spend.
An AWS Budgets configuration named Learning-Monthly-5-USD.
Any daily email subscription that you created in AWS Cost Anomaly Detection.
The local checklist file at Documents\aws-project-safety-checklist.txt.

Keep the Account Foundation

Keep root MFA enabled.
Keep the root email inbox accessible.
Keep the primary contact phone number current.
Keep IAM User and Role Access to Billing Information activated while IAM identities need billing data.
Keep Receive AWS Free Tier alerts selected.

Keep everything running

No action is needed. Choose this option if you plan to use the learning account for future projects.

Use learning-admin for future console work.
Review Documents\aws-project-safety-checklist.txt before each future AWS project.
Review Documents\aws-project-safety-checklist.txt after each future AWS project.
Leave Learning-Zero-Spend configured.
Leave Learning-Monthly-5-USD configured.
Leave the learner-sized anomaly subscription configured when one is available.

Pause - I'll come back to this later

Pausing ends your console session while leaving every passive safeguard ready for your return.

Sign out of the AWS Management Console.
Keep both budgets configured.
Keep the anomaly subscription configured when one is available.
Keep Documents\aws-project-safety-checklist.txt in your Documents folder.

Delete - I don't want to use this again

Remove the project-specific resources only if you are closing the account or replacing the IAM administrator with federation. Keep root MFA active throughout this cleanup.

The two budgets are the first cost configurations to remove.

Return to Billing and Cost Management.
Choose Budgets.
Select Learning-Zero-Spend.
Choose Delete for the selected budget.
Select Learning-Monthly-5-USD.
Choose Delete for the selected budget.

An anomaly subscription needs cleanup only when you created it during the Secret Mission.

Choose Cost Anomaly Detection in Billing and Cost Management.
Choose Alert subscriptions.
Select only the daily email subscription that you created during the Secret Mission.
Choose Delete for the selected subscription.

Keep an automatic or existing subscription that you edited. No anomaly cleanup is needed when the account has no monitor.

The checklist is the only local project file.

Press the Windows key to open system search.
Search for File Explorer.
Open File Explorer from the search result.
Open the Documents folder.
Select aws-project-safety-checklist.txt.
Press the Delete key.

Deleting learning-admin removes your everyday administrative sign-in. Continue only after replacement federation works or when you are closing the account.

Sign out of the AWS Management Console as learning-admin.
Sign in with the replacement federated administrator when one exists.
Sign in as Root user only when you are closing the account without a replacement administrator.

The final identity cleanup removes the MFA association before removing the user.

Return to IAM.
Choose Users.
Open learning-admin.
Remove the assigned MFA association under Security credentials.
Remove learning-admin from LearningAccountAdmins.
Return to Users.
Select learning-admin.
Choose Delete for the selected user.

The empty administrative group can now be removed.

Choose User groups in IAM.
Select LearningAccountAdmins.
Choose Delete for the selected group.

Nice Work!

You did it! Your AWS learning account now uses an MFA-protected IAM administrator for everyday console work. Layered cost guardrails now give each future learning project a safer starting point.

What you learned:

Established root-user isolation with tested MFA. Confirmed that the recovery email inbox remains accessible. Confirmed that the primary contact phone can receive recovery messages. Kept root access keys out of the account.
Created everyday administrative access through learning-admin. Assigned AdministratorAccess through LearningAccountAdmins. Protected the sign-in with a separate MFA token. Created no access keys.
Built layered cost guardrails with the 85 percent Free Tier email alert from AWS Billing and Cost Management. Added the Learning-Zero-Spend budget. Added the $5 Learning-Monthly-5-USD budget. Saved a regional cleanup routine in Documents\aws-project-safety-checklist.txt.
Secret Mission: tuned an available AWS Cost Anomaly Detection daily email subscription to a $1 absolute threshold. When no monitor was available, documented that state. The two budgets remained the primary guardrails.

Ready to quiz yourself?