A new AWS account comes with powerful defaults—and a few dangerous gaps. Configuring root account security, billing alerts, IAM users, MFA, and regional settings early on can prevent costly mistakes and security breaches before they happen. This post walks through the 10 most important settings to tackle first.
Opening a fresh AWS account feels like getting the keys to a massive building with thousands of rooms. The possibilities are genuinely exciting. But before you spin up your first EC2 instance or experiment with Lambda, there are foundational settings that need your attention.
Skipping these configurations is one of the most common mistakes new AWS users make. The consequences range from unexpected bills running into the hundreds of dollars to serious security incidents. According to a 2023 report by Datadog, 63% of AWS customers have at least one publicly exposed S3 bucket—a risk that proper account hygiene can help prevent.
The good news? Getting these settings right takes less than an hour. Here’s exactly where to start.
1. Secure Your AWS Root Account Immediately
The root account is the most powerful credential in AWS. It has unrestricted access to every service and resource—which is precisely why you should lock it down and stop using it for everyday tasks.
Start by adding a strong, unique password to your root account. Then enable Multi-Factor Authentication (MFA) for the root user. Navigate to the IAM dashboard, select “Add MFA for root user,” and follow the prompts to link an authenticator app like Google Authenticator or Authy.
Once MFA is active, store your root credentials somewhere secure and treat them like a break-glass emergency option.
2. Enable MFA on All IAM Users
Speaking of MFA—don’t stop at the root account. Any IAM user with console access should also have MFA enabled. AWS supports virtual MFA devices, hardware tokens, and FIDO2 security keys.
To enforce this at scale, attach an IAM policy that denies all actions unless MFA has been authenticated. AWS provides a managed example policy (AWSMFAForce) that you can use as a starting point.
3. Create an IAM Admin User (and Stop Using Root)
Once your root account is secured, create a dedicated IAM user with administrative privileges for your day-to-day tasks. Attach the AdministratorAccess managed policy to this user and use it instead of root for all routine operations.
This separation is critical. If your IAM credentials are ever compromised, you can revoke and replace them without touching the root account.
4. Set Up AWS Billing Alerts
AWS bills can escalate quickly—especially for those new to cloud pricing. Setting up billing alerts ensures you’re notified before costs spiral out of control.
Go to the Billing and Cost Management console, then navigate to Budgets. Create a monthly cost budget and configure an alert to notify you when actual or forecasted spending exceeds a threshold you’re comfortable with. A common starting point is $10 or $20 for personal accounts.
Also enable Cost Explorer while you’re there. It gives you a visual breakdown of spending by service, region, and time period—invaluable when you’re tracking down unexpected charges.
5. Configure CloudTrail for Account-Wide Logging
AWS CloudTrail records every API call made in your account. Without it, you have no audit trail if something goes wrong—whether that’s an accidental deletion, unauthorized access, or a misconfigured resource.
Enable CloudTrail in the management console and configure it to log events across all AWS Regions. Store logs in an S3 bucket and, for stronger protection, enable S3 Object Lock to prevent log tampering.
This is a non-negotiable step for any account that will handle sensitive data or production workloads.
6. Enable AWS Config
CloudTrail tells you who did what. AWS Config tells you what your resources look like right now—and how they’ve changed over time.
AWS Config continuously monitors resource configurations and can alert you when something drifts from a desired state. For example, it can flag an S3 bucket that becomes public or a security group that opens port 22 to the world.
Enable AWS Config in your primary region from day one. Add AWS managed rules like s3-bucket-public-read-prohibited and restricted-ssh to catch common misconfigurations automatically.
7. Set Your Default Region
AWS defaults to US East (N. Virginia) for many services, but your preferred region may be different based on your user base, compliance requirements, or latency needs.
Set a default region in the AWS Management Console by selecting it from the region dropdown in the top-right corner. For CLI users, run aws configure and specify your preferred region during setup.
Getting this right early prevents the frustration of accidentally deploying resources in the wrong region—and the headache of tracking down orphaned infrastructure later.
8. Harden Your Default VPC Security Groups
Every AWS account comes with a default VPC in each region, and that VPC includes a default security group. By default, this security group allows all outbound traffic and permits inbound traffic from other instances in the same group.
At minimum, restrict inbound rules on the default security group so it denies all traffic unless explicitly allowed. Better yet, avoid using the default VPC for production workloads entirely—create a custom VPC with properly segmented subnets and tightly scoped security groups instead.
9. Enable Amazon GuardDuty
Amazon GuardDuty is a managed threat detection service that analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to identify suspicious activity. It uses machine learning and threat intelligence feeds to surface things like unusual API calls, cryptocurrency mining, or compromised credentials.
GuardDuty offers a 30-day free trial and costs as little as a few dollars per month for small accounts after that. Enable it in every region you plan to use—threats don’t limit themselves to your primary region.
10. Review and Configure IAM Password Policies
If you plan to create multiple IAM users, a strong password policy is essential. Navigate to the IAM console and set a custom account password policy that enforces minimum length (14+ characters is recommended), requires uppercase and lowercase letters, numbers, and symbols, and enforces password expiration.
This is particularly important for team accounts or any environment where multiple people have console access.
Build Security In From the Start
The settings above aren’t glamorous. They won’t help you build faster or unlock new features. But they form the security and operational foundation that everything else sits on—and retrofitting them later is far harder than getting them right at the beginning.
Think of this checklist as the pre-flight check before takeoff. Boring? Maybe. Necessary? Absolutely.
Once these configurations are in place, you’re in a much stronger position to explore what AWS actually offers—with confidence that your account isn’t sitting wide open while you do.
Frequently Asked Questions
Should I use my root account for daily AWS tasks?
No. The root account should be used only for tasks that specifically require root-level access, such as changing account settings or closing the account. For all other tasks, create and use an IAM user with appropriate permissions.
How much does enabling AWS CloudTrail and GuardDuty cost?
AWS CloudTrail provides one free trail per region that delivers management events to an S3 bucket. Additional trails incur charges. Amazon GuardDuty includes a 30-day free trial; after that, pricing is based on the volume of data analyzed, typically a few dollars per month for small accounts.
What is the difference between CloudTrail and AWS Config?
AWS CloudTrail logs API activity—who made a call, when, and from where. AWS Config tracks the state and configuration of your AWS resources over time. Both services complement each other and are recommended for any serious AWS environment.
How do I avoid surprise AWS bills?
Set up a monthly budget with email alerts in the AWS Billing and Cost Management console. Enable Cost Explorer to monitor spending by service and region. For extra protection, set up a zero-spend budget that alerts you when any charges are incurred.
Is it necessary to configure all 10 settings for a personal or learning account?
The most critical settings for any account—personal or professional—are root account MFA, billing alerts, and CloudTrail. The remaining settings become increasingly important as you store sensitive data or move toward production use cases.
You can also visit for more information : What Happens When AWS Promotional Credits Expire?