Secure and Optimize Your AWS Account

Lock down your AWS account and build a cost governance layer.

Introduction

30 Second Summary

Every AWS account starts as an open book. No spending limits, no alerts, and a root login that could rack up thousands in charges if compromised.

In this project, you will build a complete cost-and-security governance layer on your AWS account. You will lock down your root account, set up budget alerts, enable ML-powered anomaly detection, and surface real savings recommendations.

What You'll Build

Open your AWS Billing console and see a working system that watches your spending for you. Budgets email you before costs surprise you, anomaly detection catches unusual patterns automatically, and a dashboard tells you exactly where to cut waste.

By the end of this project, you'll have:

A locked-down root account with MFA enabled, and a dedicated IAM admin user you use for daily operations instead of root.
A proactive alerting system where AWS Budgets emails you at 80% and 100% of your monthly spend, and Cost Anomaly Detection flags unusual patterns using machine learning.
A Cost Optimization Hub dashboard showing concrete dollar-amount savings you can act on across your entire account.
Secret Mission: Configure a Budget Action that automatically restricts IAM permissions when your spend crosses a threshold.

Are there any prerequisites?

You need an existing AWS account with console access. This project works whether your Free Tier has expired or not. All services used are permanently free regardless of Free Tier status.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters. This is your chance to commit to the goal before any hands-on work begins.

Secure Your Root Account and Create an IAM Admin User

Your AWS root account has unrestricted access to everything in your account, including billing. If it gets compromised, an attacker can spin up expensive resources with no limits.

Locking down your root account with MFA and operating through a least-privilege IAM admin user is the single most impactful security action you can take. In this step, you will enable MFA on root, create a dedicated admin user, and activate billing access for that user.

In this step, get ready to:

Enable MFA on your root account using an authenticator app.
Create an IAM admin user with console access and the AdministratorAccess policy.
Activate IAM access to the Billing and Cost Management console.

Enable MFA on your root account

MFA adds a second layer of authentication on top of your password. Even if someone steals your root credentials, they cannot sign in without the code from your phone.

In the AWS Management Console (you should already be signed in as root), click your account name in the top-right corner of the navigation bar.
Select Security credentials.
Scroll down to the Multi-Factor Authentication (MFA) section.
Choose Assign MFA device.
Type a device name (for example, my-phone), select Authenticator app, then choose Next.
Open your authenticator app on your phone (such as Google Authenticator or Authy) and scan the QR code displayed on screen.
Enter the six-digit code currently shown in your authenticator app into the MFA code 1 box.
Wait about 30 seconds for a new code to appear, then enter the new code into the MFA code 2 box.
Choose Add MFA.

Why two codes?

AWS asks for two consecutive time-based codes to confirm your authenticator app is properly synchronized. The codes expire quickly, so enter them promptly after they appear.

Confirm MFA is active by checking for a green checkmark next to your MFA device in the Multi-Factor Authentication (MFA) section.

Don't see the green checkmark?

Make sure you submitted both codes before they expired. If the device shows as out of sync, choose the device and select Resync to try again.

Help me troubleshoot my MFA setup for the root user.

Create an IAM admin user with least-privilege

Now that root is locked down, you need a separate user for everyday console access. This follows the AWS best practice of never using root for daily tasks.

In the left navigation pane of the IAM console, choose Users.
Choose Create user.
On the Specify user details page, enter a username in the User name field (for example, admin-yourname).
Check the box next to Provide user access to the AWS Management Console.
Select I want to create an IAM user.
Under Console password, choose Autogenerated password.
Choose Next.

On the Set permissions page, select Attach policies directly.
In the search box under Permissions policies, type AdministratorAccess.
Select the checkbox next to the AdministratorAccess managed policy.
Choose Next.

On the Review and create page, confirm the details look correct.
Choose Create user.
On the Retrieve password page, choose Download .csv file to save your sign-in credentials (URL, username, and password).
Store this file somewhere safe. You will need it to sign in shortly.

What is AdministratorAccess?

AdministratorAccess is an AWS managed policy that grants full access to all AWS services and resources. Attaching it directly to your IAM user follows the principle of least-privilege relative to root, because IAM users can be individually audited, have MFA enforced, and can be deleted without affecting the account itself.

Now enable MFA on your new IAM admin user as well.

In the Users list, choose the name of your new user.
Choose the Security credentials tab.
Under Multi-factor authentication (MFA), choose Assign MFA device.
Follow the same authenticator app process you used for root: name the device, scan the QR code, and enter two consecutive codes.
Choose Add MFA.

Use a separate entry in your authenticator

Your authenticator app can hold multiple accounts. Make sure you create a new entry for this IAM user rather than overwriting your root entry. Label them clearly (for example, "AWS Root" and "AWS Admin").

Having trouble creating the user?

Make sure you are still signed in as root. Only a user with IAM permissions can create other users, and root has all permissions by default.

Help me troubleshoot creating an IAM admin user.

Activate IAM access to billing

By default, IAM users cannot access the Billing and Cost Management console even if they have full admin permissions. You need to flip a switch as root to allow it.

Click your account name in the top-right corner of the navigation bar.
Select Account.
Scroll down to the IAM User and Role Access to Billing Information section.
Choose Edit.
Select the Activate IAM Access checkbox.
Choose Update.

You should see a confirmation message: "IAM user/role access to billing information is activated."

Why is this a separate setting?

AWS deliberately separates billing access from general permissions as an extra safety layer. This one-time root-only action unlocks the Billing console for your IAM user. Without it, even AdministratorAccess cannot view billing data.

Before you move on, predict what will happen: do you think you can sign in as your new IAM admin user and see the full AWS Console dashboard?

Sign out of the root account by clicking your account name in the top-right corner, then choosing Sign out.
Navigate to your account sign-in URL (found in the .csv file you downloaded, or use the format https://YOUR_ACCOUNT_ID.signin.aws.amazon.com/console/).
Select IAM user and enter your account ID.
Enter the username and password from your downloaded .csv file.
When prompted for MFA, enter the current code from your authenticator app.

You should now see the AWS Console Home dashboard, signed in as your IAM admin user. Your account name in the top-right corner shows your IAM username instead of "Root user."

Can't sign in as your IAM user?

Double-check you are using the correct account ID or alias in the sign-in URL. Make sure you downloaded the .csv file before closing the user creation page. If you lost the password, sign back in as root and reset it from the user's Security credentials tab.

Help me sign in as my new IAM admin user.

Your root account is now locked down with MFA, and you have a dedicated admin user for everyday use. Next up, you will explore Cost Explorer and get your first honest look at where your money is going.

Explore Cost Explorer and See Your Real Spending

Your account is now locked down with MFA and a dedicated admin user. The security foundation is in place.

Now you need visibility into your actual spending. You cannot optimize costs you cannot see. Cost Explorer gives you an honest, graphical breakdown of where your money is going, service by service.

In this step, get ready to:

Enable Cost Explorer and see your spending breakdown by service.
Explore your spending trends over the last 3 months.
Activate cost allocation tags and tag an existing resource.

Enable and launch Cost Explorer

Cost Explorer is the tool that lets you visualize your AWS spending over time. Enabling it also automatically sets up Cost Anomaly Detection with a default monitor in the background.

In the AWS Console, search for Billing and Cost Management in the top search bar and select it.
In the left navigation pane, choose Cost Explorer.
Choose Launch Cost Explorer.

The Cost Explorer dashboard loads, showing your estimated month-to-date costs, forecasted month-end costs, a graph of your daily costs, and your top cost trends.

What just happened behind the scenes?

Enabling Cost Explorer automatically configured Cost Anomaly Detection with an AWS services monitor and daily summary alert. This default monitor alerts when anomalous spend exceeds $100 and 40% of expected spend.

You will create a custom monitor with a much lower threshold in Step 4. For now, it is running in the background for free.

Don't see a Launch Cost Explorer button?

If Cost Explorer was previously enabled on your account, you will land directly on the dashboard instead. That is fine. Continue to the next substep.

If you see a permissions error, confirm that you activated IAM access to billing in Step 1 while signed in as root.

Help me fix my Cost Explorer permissions error

Explore your spending patterns

The dashboard gives you a high-level view, but you need to dig into which services are costing you money. Grouping costs by service reveals your top cost drivers at a glance.

On the Cost Explorer dashboard, choose Explore costs in the upper-right corner of the daily costs graph.
In the Group by dropdown, select Service.
Choose the time granularity Monthly.
Set the time range to the last 3 months using the calendar or the Auto-select dropdown.
Choose Apply.

You should now see a bar chart with each bar broken down by service, showing your costs for the last 3 months. A data table below the chart lists each service and its costs per month.

What should I look for?

Identify which services are your top cost drivers. Common ones include EC2, S3, RDS, and data transfer. Note which regions they run in.

These observations will help you make smart decisions about budgets and optimization later. Cost Explorer can display up to 13 months of historical data if your account has that much history.

Seeing zero costs or an empty chart?

If your account has no running resources, the chart may show $0.00 across all months. That is expected. The important thing is that Cost Explorer is enabled and you can see the interface. Costs will appear as you use services.

Help me understand why Cost Explorer shows zero costs

Apply cost allocation tags to existing resources

Tags are labels you attach to AWS resources to organize costs. By activating cost allocation tags, you can later filter Cost Explorer by project or environment to see exactly where each dollar goes.

In the Billing and Cost Management console, choose Cost allocation tags in the left navigation pane.

Why activate tags here first?

You must first apply tags to resources, then activate those tag keys in this console. Activation tells AWS to include those tags in your billing reports.

Tags can take up to 24 hours to appear on this page after you apply them to a resource.

Before you can activate tags here, you need to apply them to at least one resource. You will tag an existing resource first, then come back to activate the tag keys.

Open a new browser tab and navigate to a service that has an existing resource in your account (for example, the S3 console if you have a bucket, or the EC2 console if you have an instance).
Select one of your existing resources (such as an S3 bucket).
Navigate to its Properties or Tags tab.
Choose Manage tags or Edit tags.
Add a tag with Key Project and Value learning.
Add a second tag with Key Environment and Value dev.
Choose Save.

Your resource now has two user-defined tags applied. Confirm you can see both tags listed on the resource's tags section.

Switch back to the Cost allocation tags page in the Billing and Cost Management console.
If your tag keys Project and Environment already appear in the User-Defined Cost Allocation Tags tab, select both of them and choose Activate.
If they do not appear yet, this is normal. It can take up to 24 hours for newly applied tag keys to show up on this page. Bookmark this page and return later to activate them.

How do real companies use cost allocation tags?

Teams tag resources with keys like Project, Environment, Team, and CostCenter. Once activated, these tags appear as columns in cost allocation reports and as filter options in Cost Explorer.

This lets finance teams see exactly how much each project or environment costs per month.

Can't find the Tags or Properties tab?

The tag management interface varies by service. For S3 buckets, it is under Properties. For EC2 instances, it is a dedicated Tags tab. Look for a section labeled Tags on the resource detail page.

Help me find where to add tags to my AWS resource

Before you move on, do you think your newly applied tags will immediately appear in Cost Explorer reports? Or will there be a delay?

There will be a delay. Cost allocation tags are not retroactive. Only costs incurred after activation are tagged in reports. It can also take up to 24 hours for the tags to fully activate and start appearing in Cost Explorer.

You now have full visibility into your AWS spending. Cost Explorer shows your costs broken down by service, and your cost allocation tags are ready to track spend by project.

Next up, you will make this monitoring proactive by creating budgets that alert you before costs spiral.

Create a Budget with Email Alerts

In the previous step, you explored Cost Explorer and saw exactly where your money goes. The problem is that Cost Explorer is reactive. You only notice spending problems when you remember to check.

A budget with alerts makes your cost monitoring proactive by pushing email notifications to you before costs spiral. In this step, you will create two AWS Budgets that watch your spend and email you when thresholds are crossed.

In this step, get ready to:

Create a monthly cost budget with a $10 threshold.
Configure email alerts at 80% actual spend and 100% forecasted spend.
Create a tag-filtered budget that tracks costs for your learning project specifically.

Create a monthly cost budget

Your first budget will monitor total account spending each month. When spend reaches a threshold you define, AWS emails you automatically.

In the Billing and Cost Management console, choose Budgets in the navigation pane.
At the top of the page, choose Create budget.
Under Budget setup, choose Customize (advanced).
Under Budget types, choose Cost budget.
Choose Next.

Why Customize (advanced) instead of a template?

The simplified template creates a basic budget with default thresholds. The advanced workflow lets you configure multiple alert thresholds (actual and forecasted) and add tag-based filters, which you need for this project.

Under Details, for Budget name, enter Monthly-Total-Budget.
Under Set budget amount, for Period, choose Monthly.
For Budget renewal type, choose Recurring budget.
For Budgeting method, choose Fixed.
Enter 10 as the budgeted amount.
Leave Budget scope filters empty for now (this budget tracks all account spending).
Choose Next.

Pick a budgeted amount that fits your account

If your typical monthly spend is higher than $10, set the amount slightly above your normal costs so you get meaningful alerts. The goal is to catch unexpected spikes, not to trigger alerts every month.

Configure alert thresholds

You are now on the Configure alerts step of the budget wizard. This is where you tell AWS when to send you a notification email.

Choose Add an alert threshold.
Under Set alert threshold, for Threshold, enter 80.
Next to the amount, choose % of budgeted amount.
Next to the threshold, choose Actual (this alerts you based on real spend that has already happened).
Under Notification preferences, enter your email address in the Email recipients field.

Now add a second alert that watches forecasted spend.

Choose Add an alert threshold again to add a second alert.
For Threshold, enter 100.
Choose % of budgeted amount.
Choose Forecasted (this alerts you when AWS predicts you will exceed the budget before the month ends).
Enter your email address in the Email recipients field.
Choose Next.

Why two different alert types?

The 80% Actual alert tells you when real spend has reached $8 of your $10 budget. This is a "you're already here" warning.

The 100% Forecasted alert tells you AWS predicts you will hit $10 before the month ends, even if you have not reached it yet. This is a "you're heading there" early warning that gives you time to act.

On the Attach actions page, skip this step for now by choosing Next.
Review your budget settings on the summary page.
Choose Create budget.

You are taken back to the Budgets page. You should see Monthly-Total-Budget listed with its status and current vs. budgeted amounts.

Don't see your budget listed?

Make sure you completed both alert thresholds with an email address. AWS requires at least one notification recipient (email or SNS topic) per alert before you can create the budget.

help me figure out why my AWS budget did not save

Create a tag-filtered budget

Your first budget watches all spending across the entire account. In real companies, teams create separate budgets per project or environment using tag filters. You activated cost allocation tags in the previous step, so you can now filter a budget by them.

On the Budgets page, choose Create budget again.
Under Budget setup, choose Customize (advanced).
Under Budget types, choose Cost budget, then Next.
For Budget name, enter Learning-Project-Budget.
Set Period to Monthly, Budget renewal type to Recurring budget, and Budgeting method to Fixed.
Enter 5 as the budgeted amount.

Now add the tag filter so this budget only counts costs from tagged resources.

Under Budget scope, choose Add filter.
Select Tag as the filter dimension.
Choose the tag key Project and select the value learning.
Choose Next.

What if the Project tag does not appear?

Cost allocation tags can take up to 24 hours to appear in budget filters after activation. If you do not see Project in the tag list, wait and try again later. Your budget will still work once the tag propagates.

Choose Add an alert threshold.
For Threshold, enter 80 and choose % of budgeted amount.
Choose Actual.
Enter your email address in the Email recipients field.
Choose Next.
Skip the Attach actions page by choosing Next.
Review your settings and choose Create budget.

Before you check the Budgets page, what do you expect to see listed there now?

You should see both Monthly-Total-Budget and Learning-Project-Budget on the Budgets page, each showing their budgeted amount and current status. The Monthly-Total-Budget lists your email address as the notification recipient for both thresholds.

How do tag-filtered budgets help teams?

In real companies, teams tag resources by project, environment, or team name. Each team gets a budget filtered to their tag, so they own their spend independently of the total account budget. This is how cost accountability scales across an organization.

Budget shows $0 current spend?

This is normal if you have not incurred charges against the filtered tag yet. The budget starts tracking from the moment you create it and reports spend as charges appear in billing data (which can lag by a few hours).

help me understand my tag-filtered budget showing zero spend

Your account now has proactive cost monitoring. Next up, you will add an even smarter layer of protection by configuring Cost Anomaly Detection to catch unusual spending patterns that static budget thresholds might miss.

Set Up Cost Anomaly Detection

Your budgets are in place. You now have proactive email alerts that fire at your 80% and 100% spend thresholds.

But static budgets have a blind spot. What if your spend doubles from $2 to $4?

A $10 budget would never trigger on that spike. In this step, you'll set up Cost Anomaly Detection, which uses machine learning to learn your normal spending patterns and flag deviations regardless of the absolute amount.

In this step, get ready to:

Review the default anomaly monitor and understand its limitations.
Create a custom anomaly monitor with a lower detection threshold.
Configure an alert subscription that emails you when unusual spend is detected.

Review the default anomaly monitor

When you enabled Cost Explorer in Step 2, AWS automatically configured Cost Anomaly Detection with a default monitor. Let's take a look at what it covers and where it falls short.

In the Billing and Cost Management console, choose Cost Anomaly Detection in the navigation pane.

You should see an AWS-managed monitor already listed. This is the default monitor that was auto-created when you enabled Cost Explorer.

What does this default monitor do?

The default monitor alerts when anomalous spend exceeds $100 and 40% of expected spend. For a small account spending $5 to $10 per month, a $100 threshold means you would never get an alert.

Unexpected spend is also a security signal. Compromised credentials often show up first as a sudden spike in resource usage. A lower threshold catches these faster.

Create a custom anomaly monitor with a lower threshold

You'll create your own monitor that watches all AWS services and pairs with a much tighter alert threshold.

Choose the Cost monitors tab.
Choose Create monitor.
For Monitor method, select Managed by AWS.
For the dimension, select AWS services.
Name your monitor All-Services-Low-Threshold.

What does Managed by AWS mean?

The "Managed by AWS" method automatically tracks all values within the dimension you chose. Since you selected AWS services, this monitor watches every service in your account without you needing to pick them individually.

The alternative, "Customer managed", lets you select up to 10 specific values. Managed by AWS is the better default because you never miss a new service spinning up.

Configure an alert subscription with a tighter threshold

The monitor detects anomalies, but you need a subscription to actually get notified. You'll set a $5 threshold so even small unexpected charges trigger an email.

In Step 2 of the monitor creation wizard, choose Create a new subscription.
Set the threshold to alert when anomalous spend exceeds $5.
Enter your email address as the recipient.
Choose Create monitor.

Why $5 as a threshold?

For a small account, $5 in anomalous spend is a significant deviation. This is much more useful than the default $100 threshold, which would only fire after a catastrophic spike.

The threshold is on anomalous spend specifically, not total spend. Cost Anomaly Detection will only alert you when it detects spending that deviates from your historical patterns by more than $5.

How quickly does the monitor start working?

Cost Anomaly Detection runs roughly three times daily. New monitors start detecting after approximately 24 hours. New services in your account typically need approximately 10 days of history before the ML model can baseline their expected spend.

Before you verify, do you expect to see one monitor or two in the Cost monitors tab?

Navigate back to the Cost monitors tab in Cost Anomaly Detection.

You should see two monitors listed. The original AWS-managed default monitor and your new All-Services-Low-Threshold monitor with an active alert subscription showing your email address.

Don't see your custom monitor?

Make sure you clicked Create monitor at the final step of the wizard. If you navigated away before completing, the monitor was not saved.

Check that you are on the Cost monitors tab, not the Overview tab. The monitor list lives under Cost monitors.

Help me troubleshoot my Cost Anomaly Detection monitor setup.

Your account now has two layers of anomaly detection watching your spend patterns. Next up, you'll enable Cost Optimization Hub to get concrete recommendations on where you can save money.

Enable Cost Optimization Hub

Your account now has budget alerts and anomaly detection watching for unusual charges. You know when you are overspending. The missing piece is knowing where to spend less.

Cost Optimization Hub answers that question. It consolidates specific, actionable recommendations into one dashboard with dollar-amount savings estimates. Instead of hunting through individual service consoles, you get a single view of rightsizing opportunities, idle resources, and Savings Plans suggestions.

In this step, get ready to:

Enable Cost Optimization Hub for your account.
Explore the optimization dashboard and recommendations.
Review savings estimation mode and filter recommendations by your tags.

Enable Cost Optimization Hub

Cost Optimization Hub needs to be turned on before it can start importing recommendations from across your account.

In the Billing and Cost Management console, choose Cost Optimization Hub in the navigation pane.
On the Cost Optimization Hub page, choose Enable Cost Optimization Hub for this account only.
Choose Enable.

What just happened?

AWS automatically created a service-linked role that gives Cost Optimization Hub read-only access to analyze your resources across all Regions. You did not need to create this role manually.

It can take up to 24 hours for recommendations to fully populate. The dashboard may show limited data right now, and that is completely normal.

Explore the dashboard and recommendations

The dashboard gives you an immediate overview of where savings opportunities exist across your account.

Under Aggregate estimated savings by, choose Resource type to see which types of resources have the most optimization potential.
Switch to Recommended action to see the types of actions available (rightsizing, deleting idle resources, purchasing Savings Plans).
Look for any idle resources, rightsizing opportunities, or Savings Plans recommendations in the chart.

What if I see no recommendations?

If your account has minimal resources, Cost Optimization Hub may show zero recommendations. This is expected. The dashboard refreshes daily and reflects your usage up to the previous day.

The important thing is that the dashboard loaded and the feature is active. As you create more resources, recommendations will appear automatically.

Connect Cost Optimization Hub to your tagging strategy

The cost allocation tags you activated earlier also work inside Cost Optimization Hub. You can aggregate recommendations by tag key to see savings opportunities for specific projects or environments.

In the navigation pane, choose Cost Management preferences.
On the Preferences page, choose the Cost Optimization Hub tab.
Under Savings estimation mode, note whether it is set to After discounts or Before discounts.

What is the difference between these modes?

After discounts estimates savings by incorporating your existing Reserved Instances and Savings Plans. This shows what you would save on top of discounts you already have.

Before discounts uses AWS public On-Demand pricing without incorporating any discounts. This gives you a raw view of potential savings if you were paying full price.

For most learners, the default setting is fine. You can always change it later.

Navigate back to Cost Optimization Hub in the navigation pane.
Under Aggregate estimated savings by, choose Tag key.
Confirm that you can see your tag keys listed (such as Project or Environment). If recommendations exist for tagged resources, they appear grouped by tag.

Why does tagging matter here?

In real companies, teams use tags to track which projects or environments drive the most cost. Aggregating recommendations by tag key lets you answer questions like "How much can the production environment save?" or "Which project has the most idle resources?" without digging through individual services.

Before you move on, take a moment to predict what you expect to see on the Cost Optimization Hub dashboard right now. Do you think it shows recommendations, or is it still importing?

Choose Cost Optimization Hub in the navigation pane and confirm the dashboard loads showing your cost optimization opportunities (or a message indicating recommendations are being imported).

You should see the Cost Optimization Hub dashboard with the Aggregate estimated savings by options visible. If your account has active resources, you may already see specific dollar-amount savings. If not, you will see the dashboard structure ready to populate within 24 hours.

Dashboard not loading?

Make sure you are signed in as your IAM admin user, not the root account. Your IAM user has billing access enabled from Step 1.
Confirm you chose Enable on the Cost Optimization Hub page. If you see the enable prompt again, the feature was not activated.
If you see a permissions error, verify that AdministratorAccess is attached to your IAM user.

Still stuck? Help me troubleshoot why Cost Optimization Hub is not loading.

Your cost governance layer is complete. You have budget alerts for proactive warnings, anomaly detection for pattern-based monitoring, and Cost Optimization Hub for actionable savings recommendations. Next up, take on the Secret Mission to automate cost enforcement with Budget Actions.

Secret mission

Configure a Budget Action to Auto-Restrict Permissions

Your budgets send email alerts, but emails require a human to act. What if your AWS account could defend itself automatically? In this secret mission, you will configure a Budget Action that applies an IAM Deny policy the moment your spend crosses a threshold. No human intervention needed.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. Every service used in this project is permanently free regardless of Free Tier status, so there are no ongoing costs.

Resources you used:

IAM admin user with AdministratorAccess policy and MFA (free).
2 AWS Budgets: Monthly-Total-Budget (with Budget Action) and Learning-Project-Budget (free).
Custom Cost Anomaly Detection monitor: All-Services-Low-Threshold (free).
Cost Optimization Hub enrollment (free).
Cost allocation tags: Project and Environment (free).
IAM policy DenyEC2Launch and IAM role BudgetActionsRole from Secret Mission (free).

Keep everything running

No action needed. Choose this if you want your governance layer to keep protecting your account. Everything you built is permanently free and actively monitors your spend, alerts you to anomalies, and surfaces savings opportunities.

Your budgets continue sending email alerts at 80% and 100% thresholds.
Cost Anomaly Detection continues scanning for unusual spend patterns.
Cost Optimization Hub continues surfacing savings recommendations.
Your Budget Action remains on standby, ready to restrict EC2 launches if your threshold is crossed.

Pause - I'll come back to this later

There is no running compute to pause. All resources in this project are configuration-level settings that cost nothing whether active or idle.

If you want to stop receiving email alerts temporarily, edit each budget and remove your email from the notification recipients.
If you want to stop anomaly notifications, edit your alert subscription threshold to a very high value.
You can re-enable notifications at any time by adding your email back or lowering the threshold.

Delete - I don't want to use this again

Remove all project resources and start fresh. Follow these steps in order to avoid dependency issues.

Delete your budgets: In the Billing and Cost Management console, choose Budgets in the navigation pane. Select both Monthly-Total-Budget and Learning-Project-Budget. Choose Actions at the top of the page, then choose Delete. Choose Confirm.
Delete your custom anomaly monitor: In the Billing and Cost Management console, choose Cost Anomaly Detection in the navigation pane. Select the Cost monitors tab. Select All-Services-Low-Threshold and delete it.
Disable Cost Optimization Hub: In the Billing and Cost Management console, choose Cost Management Preferences in the navigation pane. Choose the Cost Optimization Hub tab. Clear the Enable Cost Optimization Hub checkbox. Choose Save preferences.
Deactivate cost allocation tags: In the Billing and Cost Management console, choose Cost allocation tags in the navigation pane. Select your Project and Environment tags and deactivate them.
Delete the Secret Mission IAM policy: In the IAM console, choose Policies in the navigation pane. Search for DenyEC2Launch. Select it, then choose Actions and Delete.
Delete the Secret Mission IAM role: In the IAM console, choose Roles in the navigation pane. Search for BudgetActionsRole. Select it, then choose Delete.
Delete the IAM admin user: In the IAM console, choose Users in the navigation pane. Select your admin user. Choose Delete and confirm. After this, sign in with your root account if you need console access.

Keep your root MFA enabled

Do not remove MFA from your root account. MFA is your primary defense against unauthorized access and should remain enabled permanently.

Nice Work!

You just built a production-grade cost governance and security layer on your AWS account. This setup covers CCP exam domains 2 (Security and Compliance) and 4 (Billing, Pricing, and Support), and it costs you nothing to keep running.

You've learned how to:

Lock down your root account with MFA and operate through a dedicated IAM admin user following least-privilege principles.
Build a proactive cost monitoring system using Cost Explorer, AWS Budgets with email alerts at 80% and 100% thresholds, and ML-powered Cost Anomaly Detection that catches unusual spend patterns early.
Enable Cost Optimization Hub to surface concrete savings recommendations, and apply cost allocation tags to track spend by project and environment.
Secret Mission: Automate cost governance by configuring a Budget Action that applies a Deny IAM policy to restrict EC2 launches when your monthly budget threshold is exceeded.

Ready to quiz yourself?