Study guide
Technical reference and lesson notes
Purpose of This Lesson
This lesson covers foundational AWS account configuration tasks that help improve account usability, cost visibility, and billing governance. For the AWS Certified Solutions Architect – Professional SAP-C02 exam, this topic matters because many scenario-based questions expect you to understand how to design secure, cost-aware AWS environments.
The key ideas are:
- Creating an AWS account alias for easier IAM user sign-in
- Understanding that IAM is a global AWS service
- Enabling IAM users and roles to access billing information
- Configuring billing preferences
- Creating AWS Budgets to alert on actual or forecasted spend
- Using Cost Explorer to investigate AWS charges
These are not complex architecture features, but they are important operational controls for real AWS environments.
Key Concepts
AWS Account Alias
An AWS account has a numeric account ID. By default, IAM users sign in using a URL that includes this account ID.
An account alias lets you replace the account ID portion of the IAM sign-in URL with a human-readable name.
For example, instead of using a sign-in URL based on a long numeric account ID, you can use an alias that is easier to remember.
This is useful because:
- IAM users do not need to remember the AWS account ID.
- The login URL becomes easier to share internally.
- It improves usability for administrators and operators.
- It is especially helpful in training, lab, or multi-account environments.
Account aliases must be globally unique across AWS. If another AWS account already uses the alias, you must choose a different one.
IAM Is a Global Service
AWS Identity and Access Management, or IAM, is a global service. IAM resources are not tied to a specific AWS Region.
This means IAM users, groups, roles, and policies are created at the account level and apply across regions.
For the exam, remember that IAM is not regional. You do not create separate IAM users in each AWS Region.
This matters because:
- IAM identities are managed centrally per AWS account.
- Permissions can grant access to resources in multiple regions.
- Some AWS services are regional, but IAM is not.
- Account-level security settings should be treated as global controls.
Root User vs IAM Administrative User
When a new AWS account is created, the root user has full access to everything in the account. However, the root user should not be used for daily administration.
A best practice is to:
- Use the root user only for tasks that require root access.
- Create an IAM administrative user or role for normal administration.
- Enable MFA on the root account.
- Avoid using root credentials for routine work.
In this lesson, the root user is still being used because the account is being initially configured. Later, administrative access should move to IAM-based identities.
IAM User and Role Access to Billing Information
By default, IAM users and roles may not be able to access billing information, even if they have administrative permissions.
AWS has a specific account-level setting that allows IAM users and roles to access billing information. Once enabled, billing access can then be controlled using IAM permissions.
This is important because without enabling this setting, AWS may require root user access to view billing data.
For a secure operational model, you generally want to enable IAM billing access and then grant billing permissions through IAM policies.
This allows billing visibility without requiring administrators to use the root account.
Billing Preferences
Billing preferences allow you to configure how AWS sends billing-related notifications and documents.
Important options include:
- Receiving AWS Free Tier usage alerts
- Enabling CloudWatch billing alerts
- Receiving invoices by PDF email attachment
Free Tier alerts help notify you if your usage approaches or exceeds Free Tier limits.
CloudWatch billing alerts allow cost-related alerting based on AWS billing data.
PDF invoices are useful for recordkeeping, accounting, and reviewing monthly AWS charges without needing to manually retrieve invoices from the console.
AWS Budgets
AWS Budgets allows you to define budget thresholds and receive alerts when actual or forecasted usage reaches specific levels.
A monthly cost budget is one of the most common budget types. For example, in a lab account, you might create a monthly budget of $5 to avoid unexpected charges.
AWS Budgets can alert when:
- Actual spend reaches a percentage of the budget
- Forecasted spend is expected to exceed the budget
- Usage, cost, reservation, or savings plan thresholds are crossed
In the lesson example, a monthly cost budget is configured so email alerts are sent when spend reaches certain thresholds.
This is a basic but important cost control. AWS Budgets does not automatically stop all resources unless you design additional automation around it. By default, it mainly provides visibility and alerting.
Forecasted vs Actual Spend
AWS Budgets can alert based on both actual spend and forecasted spend.
Actual spend means AWS charges have already accumulated.
Forecasted spend means AWS predicts that your account may exceed the budget by the end of the budget period based on current usage trends.
For cost governance, forecasted alerts are valuable because they give you a chance to react before the budget is fully consumed.
Cost Explorer
AWS Cost Explorer is used to analyze AWS spending over time.
You can use it to review:
- Charges by service
- Daily or monthly cost trends
- Usage patterns
- Cost anomalies
- Account or service-level spending
Cost Explorer may not show meaningful data immediately in a brand-new account. It can take time for billing data to populate.
For the exam, understand the distinction:
- AWS Budgets is used for alerting against thresholds.
- Cost Explorer is used for cost analysis and investigation.
Small AWS Charges Can Still Occur
Even in a lab or Free Tier account, some AWS services can create small charges.
Examples include:
- Route 53 hosted zones
- Domain registration
- Resources left running accidentally
- Storage or networking resources outside the Free Tier
- Regional services created in enabled regions
A budget is a safety net, but it does not replace good operational discipline. You still need to shut down, terminate, or clean up resources when they are no longer needed.
Exam-Relevant Takeaways
For the SAP-C02 exam, focus on the governance and operational aspects of this topic.
Remember that IAM is global, not regional. IAM identities are managed at the account level and can be used to control access across AWS services and regions.
Do not use the root account for day-to-day administration. The root user should be protected with MFA and reserved for account-level tasks that specifically require root access.
Billing access for IAM users and roles requires a separate account-level setting. Even an administrator may need this setting enabled before accessing billing information through IAM.
AWS Budgets is the correct service for setting cost or usage thresholds and sending alerts when those thresholds are approached or exceeded.
Cost Explorer is the correct service for analyzing and breaking down AWS spend after charges are generated.
For exam scenarios, AWS expects cost governance to include proactive alerting, least privilege access, and operational visibility.
Architecture Decision Guide
| Scenario | Best AWS Choice | Why |
|---|---|---|
| You need an easier IAM user login URL | AWS Account Alias | Replaces the numeric account ID in the IAM sign-in URL with a readable alias |
| You need to manage users and permissions across the account | IAM | IAM is the global identity and access service for AWS accounts |
| You need IAM admins to view billing without using root | Enable IAM user and role access to billing | Allows billing access to be controlled through IAM permissions |
| You want alerts before AWS charges become unexpectedly high | AWS Budgets | Sends notifications based on actual or forecasted spend |
| You need to investigate which AWS services caused charges | AWS Cost Explorer | Provides cost breakdowns and trend analysis |
| You want notification when Free Tier usage is exceeded | Free Tier usage alerts | Helps avoid unexpected charges in lab or low-cost accounts |
| You need a monthly invoice copy by email | Billing Preferences | Can send PDF invoices directly by email |
Common Exam Traps
Trap 1: Assuming AdministratorAccess Automatically Allows Billing Access
An IAM user with administrative permissions may still be blocked from billing information if IAM billing access has not been enabled at the account level.
The account-level billing access setting must be enabled first. Then IAM permissions can control billing access.
Trap 2: Confusing AWS Budgets with Cost Explorer
AWS Budgets is for alerting and threshold monitoring.
Cost Explorer is for analyzing and investigating costs.
If the question asks for alerts when spend exceeds a limit, think AWS Budgets.
If the question asks for identifying which service caused a cost increase, think Cost Explorer.
Trap 3: Thinking AWS Budgets Automatically Stops Charges
A budget alert does not automatically terminate resources by default.
AWS Budgets can notify users when spend exceeds a threshold, but stopping resources requires additional automation or manual action.
Trap 4: Treating IAM as Regional
IAM is global. Users, groups, roles, and policies are not created separately per region.
For regional access control, IAM policies can restrict what actions are allowed in specific regions, but IAM itself remains global.
Trap 5: Using Root for Normal Administration
The root user should not be used for routine AWS administration.
Use IAM users, IAM roles, IAM Identity Center, or federated access for normal operations.
Real-World Engineer Notes
In a real AWS environment, these account setup tasks are part of basic cloud governance.
For a production or enterprise account, you would not rely only on a single budget alert. You would likely use a combination of AWS Budgets, Cost Explorer, AWS Organizations, Service Control Policies, tagging policies, cost allocation tags, and possibly AWS Cost Anomaly Detection.
For lab or training accounts, a low monthly budget is extremely useful because it helps catch forgotten resources. Common examples include EC2 instances left running, unattached EBS volumes, NAT Gateways, Route 53 hosted zones, or test services that are not Free Tier eligible.
IAM billing access is also important operationally. Without it, administrators may keep falling back to root access for billing tasks, which is not a good security practice.
In multi-account environments, account aliases can help humans identify accounts more easily, but they are not a substitute for proper AWS Organizations structure, account naming standards, tagging, and centralized identity management.
For MSP or enterprise operations, these settings should be part of an AWS account onboarding checklist.
Quick Reference Summary
- IAM is a global AWS service.
- AWS account aliases make IAM sign-in URLs easier to remember.
- Account aliases must be unique across AWS.
- The root user should not be used for daily administration.
- IAM billing access must be enabled separately at the account level.
- Billing permissions can then be delegated using IAM.
- Billing preferences can enable Free Tier alerts, CloudWatch billing alerts, and PDF invoices.
- AWS Budgets sends alerts based on actual or forecasted spend.
- Cost Explorer is used to analyze and investigate AWS charges.
- Budget alerts help detect issues but do not automatically stop all spending by default.
Flashcards
Q: Is IAM a regional or global AWS service?
A: IAM is a global service. IAM users, groups, roles, and policies are managed at the AWS account level, not per region.
Q: What is an AWS account alias used for?
A: It creates a human-readable IAM sign-in URL instead of using the numeric AWS account ID.
Q: Does an AWS account alias need to be unique?
A: Yes. Account aliases must be unique across AWS.
Q: Should the AWS root user be used for daily administration?
A: No. The root user should be reserved for account-level tasks that require root access.
Q: Why enable IAM user and role access to billing?
A: It allows billing information to be accessed through IAM permissions instead of requiring root user login.
Q: What AWS service should you use to receive alerts when monthly spend reaches a threshold?
A: AWS Budgets.
Q: What is the difference between AWS Budgets and Cost Explorer?
A: AWS Budgets provides alerts and threshold tracking. Cost Explorer provides cost analysis and spending breakdowns.
Q: What is a forecasted budget alert?
A: An alert based on AWS predicting that your spend will exceed a budget threshold by the end of the period.
Q: Do AWS Budgets automatically stop AWS resources from running?
A: Not by default. Budgets primarily provide alerts unless additional actions or automation are configured.
Q: Why are Free Tier alerts useful?
A: They warn you when usage approaches or exceeds Free Tier limits, helping prevent unexpected charges.
Q: What service can show which AWS services are generating charges?
A: AWS Cost Explorer.
Q: Why are PDF invoice emails useful?
A: They provide a convenient billing record without requiring manual console access.
Practice Questions
Question 1:
A company has created a new AWS account. The administrator wants IAM users to use a friendly sign-in URL instead of a URL containing the numeric AWS account ID. What should the administrator configure?
A. AWS Organizations account name
B. AWS account alias
C. IAM role name
D. Route 53 hosted zone
Correct Answer:
B. AWS account alias
Explanation:
An AWS account alias creates a friendly IAM sign-in URL that replaces the numeric account ID with a readable alias.
Question 2:
An IAM administrator has full administrative permissions but cannot access AWS billing information. What is the most likely reason?
A. IAM is a regional service and the user is in the wrong region
B. Billing access for IAM users and roles has not been enabled at the account level
C. Cost Explorer has not been enabled
D. The account alias has not been configured
Correct Answer:
B. Billing access for IAM users and roles has not been enabled at the account level
Explanation:
AWS billing access for IAM users and roles requires a separate account-level setting. After it is enabled, access can be controlled with IAM permissions.
Question 3:
A solutions architect wants to receive an email when an AWS lab account is forecasted to exceed $10 in monthly charges. Which service should be used?
A. AWS Cost Explorer
B. AWS Budgets
C. AWS CloudTrail
D. AWS Config
Correct Answer:
B. AWS Budgets
Explanation:
AWS Budgets can send alerts based on actual or forecasted spend. Cost Explorer is used to analyze spending, not primarily to create budget threshold alerts.
Question 4:
A cloud engineer needs to determine which AWS services caused an unexpected increase in monthly charges. Which service is most appropriate?
A. AWS Cost Explorer
B. AWS IAM
C. AWS Budgets
D. AWS Organizations
Correct Answer:
A. AWS Cost Explorer
Explanation:
Cost Explorer provides a breakdown of AWS costs by service, time period, and other dimensions. It is used to investigate spending patterns.
Question 5:
Which statement about IAM is correct?
A. IAM users must be created separately in each AWS Region
B. IAM is global and applies at the AWS account level
C. IAM can only manage billing access
D. IAM account aliases are regional
Correct Answer:
B. IAM is global and applies at the AWS account level
Explanation:
IAM is a global service. IAM identities and policies are managed centrally within an AWS account and are not tied to a single region.