AWS accounts, Regions, IAM and lab costs

Core concepts

A Region is a geographic AWS deployment area. Availability Zones are isolated locations within a Region, connected with low-latency networking. An edge location is used by services such as CloudFront; it is not an AZ. Most resources are regional, while some identity and DNS services have global scope. AWS secures underlying cloud infrastructure. You remain responsible for choices such as instance patching, application code, access rules and data permissions. Managed services move some operational work to AWS; they do not remove your security responsibilities.

Setup steps

1. Use a dedicated learning account where possible. Protect the root user with MFA and avoid root for routine work.
2. Configure an administrator learning identity through IAM Identity Center or a suitable federated role. Use limited roles for subsequent exercises.
3. Choose one available Region and use it consistently. Examples use ap-south-1; check service availability and costs in your account.
4. Add tags Project=cloud-academy, Environment=lab, and an owner identifier. Tags support tracking; not all resource types support all tags.
5. Create an AWS Budget with actual and forecast alerts. Budgets notify; they are not a guaranteed spending hard-stop.
6. Review current prices before creating NAT gateways, load balancers, databases, EKS clusters or paid AI endpoints. Do not assume a course lab qualifies for a free tier.

Cost model

EC2 compute, provisioned disks, public IPv4 addresses, snapshots, outbound data and managed service capacity are separate cost drivers. Stopping an instance usually stops its compute usage, but retained disks, snapshots and public IPv4 allocations can still cost money. Terminating is not the same as deleting every related resource.

Verification

Locate the account ID and current Region. Open Billing access with a permitted identity, verify the budget's notification destination, and record resource names in a lab notebook. AWS CLI users can verify identity with aws sts get-caller-identity after CLI configuration in the later IAM chapter.

Cleanup habit

After each lab, record which resources remain. Delete lab-only load balancers and NAT gateways, release unused Elastic IPs, remove unattached disks and inspect retained snapshots. Keep backups only deliberately. Never run a blanket account-wide delete command.

Check yourself

Does choosing a small EC2 instance guarantee a zero bill? No: storage, addresses, traffic and eligibility are independent.

Official references

IAM security guidance AWS pricing calculator

Interview and revision check

Which costs can remain after stopping EC2?

Retained EBS storage, snapshots and allocated public IPv4 resources can still cost money. Review all related resources, not just compute state.