AWS Account Plans, Free Credits, and Safe Account Setup – SAP-C02 Study Guide

Purpose of This Lesson

Creating an AWS account is more than registering an email address. The account plan determines which services are available, whether usage can generate charges beyond promotional credits, and how long a learning account remains active.

This guide explains the AWS Free and Paid account plans introduced in July 2025, the information required during registration, the consequences of upgrading, and the first login considerations involving the root user and IAM.

Key Concepts

AWS Free and Paid Account Plans

New AWS customers can choose between a Free plan and a Paid plan. Both plans may provide promotional credits to eligible new customers:

• $100 in credits at signup.
• Up to an additional $100 by completing qualifying actions in the AWS console.
• Promotional credits are generally available only once per eligible new customer.

The plans differ primarily in service access and billing behavior.

Capability	Free plan	Paid plan
Promotional credits	Available to eligible new customers	Available to eligible new customers
Always-free usage and short-term trials	Available	Available
Service access	Selected services and features	Broad AWS service access
Usage beyond credits	No additional usage charges; account is restricted or closed when the allowance is exhausted	Usage continues and charges are applied to the payment method
Duration	Expires after six months or when credits are exhausted, whichever occurs first	No six-month expiration described by the plan
Suitable for	Short-term learning and low billing risk	Production, longer-term work, and advanced service access

The exact services and instance types available under the Free plan can change. For example, EC2 usage may be limited to selected instance types, while a Paid plan can use other instance types and incur normal charges.

Promotional Credits Are Not the Same as Free Usage

AWS credits offset eligible charges; they do not make every AWS service permanently free. A service can consume credits quickly, and some services or features may not be available under the Free plan at all.

Always check the current AWS Free Tier and account-plan documentation before starting a lab. Pricing, eligibility, service availability, credit rules, and promotional offers can change.

Free Plan Expiration and Upgrade Window

A Free plan account expires when either of these events occurs:

1. Six months pass from account creation.
2. The available promotional credits are exhausted.

After expiration, AWS provides a 90-day grace period during which the account can be upgraded to a Paid plan. Upgrading reopens the account and permits continued use.

Promotional credits themselves may have a longer validity period, such as 12 months from account creation, but the Free plan can close earlier. Upgrading before the Free plan closes may therefore preserve the ability to use remaining credits, subject to the applicable AWS terms.

Upgrading Through AWS Organizations Can Affect Credits

An account can be converted from the Free plan to the Paid plan manually or through mechanisms such as:

• AWS Organizations.
• AWS Partner programs.
• Enterprise programs.

The source material highlights an important rule: when conversion happens through Organizations or similar programs, remaining Free Tier credits may expire rather than carry over. For a learning account that still has credits, manually upgrade to the Paid plan before creating or joining an organization if preserving those credits is important.

This is especially relevant when a lab requires AWS Organizations, because creating an organization can trigger the account-plan conversion.

Root User Versus IAM User

The initial account registration creates a root user, identified by the signup email address and root password. The root user is not the same as an IAM user.

• Root user: The original identity for the AWS account, with unrestricted account-level authority. It should not be used for routine administration.
• IAM user: An identity created within the account for human or application access. IAM users authenticate using an account alias or account ID, plus an IAM username and password.

After signup, the root user can access the console using the root email address. An IAM login is not available until an IAM user has been created and configured.

For secure account administration, enable MFA on the root user, avoid using root credentials for daily work, and use appropriately governed IAM or federated identities instead.

Information Required to Create an Account

Account registration requires:

• A unique root-user email address not already associated with another AWS account.
• A unique account name.
• A strong root-user password.
• A valid credit card, even when selecting the Free plan.
• A phone number capable of receiving SMS verification.
• Personal or business contact information, depending on the account purpose.
• Agreement to AWS terms and conditions.

Some email providers support aliases, such as name+aws-lab@example.com. An alias can route mail to an existing inbox while providing a distinct address for AWS registration, assuming AWS accepts it as unique.

Account Name, Account ID, and Account Alias

These identifiers serve different purposes:

• Account ID: A numeric identifier assigned by AWS.
• Account name: A human-readable name selected during registration.
• Account alias: A friendly identifier used in some IAM sign-in URLs instead of the numeric account ID.

A consistent naming convention makes multiple lab, development, and production accounts easier to distinguish. Do not assume that an account name or alias is globally reusable; uniqueness requirements may apply.

Regions and Console Login

The AWS Management Console may open in a region based on the signup location or browser context. The selected region affects the resources displayed and, for regional services, where resources are created.

Before starting a lab:

• Confirm the selected AWS Region.
• Use the course’s designated region when one is specified.
• Remember that resources created in one region are not automatically visible in another.
• Check whether a service is regional or global before troubleshooting its availability.

Exam-Relevant Takeaways

• AWS account-plan behavior affects both service availability and billing risk.
• A Free plan is not equivalent to unrestricted AWS access. Selected services and features may be unavailable.
• A Paid plan permits broader service use, but charges can continue after promotional credits are exhausted.
• Promotional credits are not guaranteed to transfer when a Free plan account is converted through AWS Organizations or similar programs.
• The root user is created during initial account registration; IAM users must be created separately.
• A credit card may be required even when the account is intended only for free usage.
• Account closure or expiration is not a substitute for cost governance. Remove resources and configure billing notifications.
• For real environments, use account separation, least privilege, MFA, centralized billing, and organizational governance rather than relying on promotional credits.

Architecture Decision Guide

Requirement	Recommended choice	Reason
Short-term personal learning with minimal billing risk	Free plan	Limits access and prevents additional usage charges after the allowance is consumed, according to the plan rules
Need for services unavailable on the Free plan	Paid plan	Provides broader service access, with the responsibility to control costs
Long-running lab or project	Paid plan	The Free plan expires after six months or credit exhaustion
Production or business workload	Paid plan with governance	Production workloads need continuous access, monitoring, budgets, identity controls, and support options
Lab requires AWS Organizations while credits remain	Manually upgrade first, then create or join the organization	Helps avoid losing remaining credits during automatic conversion
Routine console administration	IAM, federation, or IAM Identity Center identity	Avoids daily use of root credentials and supports least privilege
Cost-sensitive experimentation	Billing alarms, budgets, tagging, and automated cleanup	Credits alone do not prevent resource waste or unexpected charges on a Paid plan

Common Exam Traps

• Assuming “Free plan” means every AWS service is free: The plan provides access only to selected services and features.
• Assuming credits prevent all charges: Credits are finite and may not apply to every service, usage type, or conversion path.
• Creating an organization before checking account-plan effects: AWS Organizations can convert the account and may cause remaining credits to expire.
• Using the IAM sign-in form immediately after signup: Initial access is through the root-user email; an IAM username does not exist until one is created.
• Treating the account name as the account ID: The account ID is numeric; the name and alias are human-friendly identifiers.
• Ignoring region selection: A resource may appear to be missing when the console is pointed at a different region.
• Assuming account closure deletes every operational concern: Review resources, charges, subscriptions, and data-retention implications before abandoning an account.
• Relying only on billing alarms: Alarms notify you; they do not automatically stop every resource or guarantee that charges cannot occur.

Real-World Engineer Notes

Establish Cost Controls Immediately

Before launching substantial resources, configure:

• AWS Budgets or billing alarms for a low threshold.
• Cost allocation tags where applicable.
• A default region strategy.
• Resource expiration or cleanup procedures for labs.
• Alerts for unusually high usage.

Terminate EC2 instances, delete unused load balancers, remove unattached EBS volumes, clean up NAT Gateways, and review data stored in S3 or other persistent services. Some resources continue incurring charges even when an application appears idle.

Protect the Root User

The root user should be reserved for tasks that specifically require root access. At minimum:

• Use a unique, strong root password.
• Enable MFA, preferably with a hardware or otherwise strongly protected authenticator.
• Do not create root access keys unless an exceptional, documented requirement exists.
• Store recovery information securely.

Use Separate Accounts for Meaningful Environments

For larger environments, separate accounts for workloads such as development, testing, security, logging, and production. AWS Organizations can centralize governance and billing, but organization design should account for the impact on account plans and promotional credits.

Verify Current Commercial Terms

The Free and Paid plan model, promotional credits, included services, expiration behavior, and conversion rules are commercial features rather than architectural invariants. Validate them against current AWS documentation when creating an account or designing a training environment.

Quick Reference Summary

• New eligible customers may receive up to $200 in promotional credits: $100 at signup and up to $100 through qualifying actions.
• The Free plan offers restricted service access and no additional charges after the allowance is consumed, but it expires after six months or credit exhaustion.
• The Paid plan offers broad service access and continues charging the payment method after credits are exhausted.
• Manually upgrade a Free plan account before using AWS Organizations if remaining credits need to be preserved.
• Registration requires a unique email, account name, payment card, contact information, and SMS-capable phone number.
• Initial console access uses the root user; IAM access requires creating an IAM identity first.
• Confirm the AWS Region before creating or locating resources.
• Configure budgets or billing alarms and clean up resources even when using a Free plan.

Flashcards

1. Q: What are the two AWS account plans discussed in this lesson?

A: The Free plan and the Paid plan.

1. Q: Who is generally eligible for the promotional signup credits?

A: Eligible new AWS customers, typically only once per customer.

1. Q: What promotional credit amounts are described?

A: $100 at signup and up to another $100 through qualifying console actions.

1. Q: What happens when a Free plan account exhausts its available credits?

A: The account is restricted or closed rather than continuing to generate additional usage charges, according to the plan rules.

1. Q: When does a Free plan account expire?

A: After six months or when its credits are exhausted, whichever occurs first.

1. Q: What happens on a Paid plan after promotional credits are exhausted?

A: Eligible usage continues and charges are applied to the configured payment method.

1. Q: Why can AWS Organizations be important when using a Free plan account?

A: It can trigger conversion to the Paid plan, and remaining credits may expire during that conversion.

1. Q: What identity is created during initial AWS signup?

A: The root user.

1. Q: What is required before using an IAM username to sign in?

A: An IAM user or another IAM-based identity must be created and configured.

1. Q: What is the difference between an AWS account ID and account alias?

A: The account ID is a numeric identifier; the alias is a friendly identifier used for IAM sign-in URLs.

1. Q: Why is a credit card required for a Free plan account?

A: AWS requires payment information on file for account verification and potential future conversion to a Paid plan.

1. Q: Why should the active Region be checked before a lab?

A: Regional resources are displayed and created within the selected Region, so the wrong Region can make resources appear missing.

Practice Questions

Question 1

A student creates a new AWS account using the Free plan. The student consumes all available promotional credits while testing permitted services. What should the student expect?

A. AWS automatically charges the saved credit card for all additional usage.
B. The account is restricted or closed rather than continuing to incur usage charges under the Free plan.
C. AWS permanently deletes the account immediately with no upgrade option.
D. The account automatically converts to an AWS Organizations member account.

Correct answer: B

Explanation: The Free plan is designed to prevent additional usage charges after its available allowance is exhausted. The account can be upgraded during the stated grace period, subject to AWS rules.

Question 2

A learner has $60 in remaining promotional credits and needs to create an AWS Organization for a lab. What is the best preparation step if the learner wants to retain the credits for future Paid plan usage?

A. Create the organization first and then request that AWS restore the credits.
B. Delete the root user before creating the organization.
C. Manually upgrade the account to the Paid plan before creating the organization.
D. Create a second root user in the same account.

Correct answer: C

Explanation: Conversion through AWS Organizations or similar programs can cause remaining Free plan credits to expire. Manually upgrading first is the recommended approach described in the lesson.

Question 3

An administrator signs out of the AWS console after creating an account. On the next login, the administrator sees fields for an account alias or ID, IAM username, and IAM password, but no IAM user has been created. Which login method should be used?

A. Sign in with the root-user email address and root password.
B. Use the account name as the IAM username.
C. Use the promotional credit number as the account ID.
D. Use the account alias with an empty IAM username.

Correct answer: A

Explanation: Signup creates the root user, which authenticates with the root email address and root password. The IAM sign-in form is used only after an IAM identity has been created.

Question 4

A company wants to run a production workload continuously and use services and features unavailable under the Free plan. Which account-plan choice is most appropriate?

A. Free plan, because production workloads cannot consume promotional credits.
B. Free plan, because it automatically prevents all resource costs.
C. Paid plan with budgets, monitoring, least-privilege access, and account governance.
D. Free plan with no payment method attached.

Correct answer: C

Explanation: The Paid plan provides broad service access and avoids the Free plan’s six-month limitation, but the company must actively manage costs and security.

Question 5

A user creates an EC2 instance but cannot find it in the console a few minutes later. The instance is known to be running and the user has permission to view it. What should be checked first?

A. Whether the account has a friendly account name.
B. Whether the console is set to the Region where the instance was created.
C. Whether the root password has expired.
D. Whether the account received the additional $100 credit.

Correct answer: B

Explanation: EC2 resources are regional. Selecting a different Region in the console can make a valid instance appear absent.