Study guide
Technical reference and lesson notes
Purpose of This Lesson
This lesson explains how AWS account setup works, the difference between the AWS Free Plan and Paid Plan, and why billing controls matter even in a training or lab environment. For the SAP-C02 exam, this topic is less about memorizing signup screens and more about understanding account governance, cost controls, root user security, AWS Organizations behavior, and when an account needs access to the full AWS service catalog.
Source note: This guide was created from the uploaded course transcript and cross-checked against current AWS Free Tier and IAM documentation. AWS currently describes the Free Plan as a no-cost, time-limited way to test AWS with up to $200 in credits, while the Paid Plan allows access to more than 150 AWS services and usage beyond credit thresholds.
Key Concepts
AWS Account Plan Types
AWS now separates new customer account setup into two main choices:
- AWS Free Plan
- AWS Paid Plan
Both options can receive AWS Free Tier credits, but they behave differently when credits are exhausted or when the account needs access to services outside the Free Plan.
The Free Plan is designed for low-risk learning. It limits access to selected AWS services and prevents unexpected charges unless the account is upgraded. The Paid Plan gives broader service access and allows usage to continue after credits are consumed, but the customer becomes responsible for any billable usage beyond the credit balance.
AWS Free Tier Credits
New AWS customers can receive $100 in credits at signup and may earn up to another $100 by completing activities in the AWS Console. AWS states that Free Tier credits expire 12 months after the account is created, but Free Plan accounts expire earlier: six months from account creation or once the credits are exhausted, whichever comes first.
This matters because the Free Plan is not the same thing as an unlimited sandbox. It is a controlled entry point into AWS with limits around service availability, duration, and credit usage.
Free Plan Behavior
The Free Plan is useful when the main goal is safe hands-on learning. The major advantage is cost protection. If the account uses all available credits or reaches the Free Plan expiration point, the account stops being accessible unless it is upgraded.
Key characteristics:
- Good for beginners and short-term training
- Access to selected AWS services and features
- No charges unless the account is upgraded to Paid Plan
- Account expires after six months or credit exhaustion
- A 90-day post-expiration window exists to upgrade the account
The Free Plan can be a good choice for introductory AWS labs, but it may block certain advanced SAP-C02 labs or services.
Paid Plan Behavior
The Paid Plan is the normal long-term AWS account model. It supports full service access and allows production-style designs, larger labs, AWS Organizations, Route 53 domain registration, and advanced services that may not be available in the Free Plan.
The tradeoff is that AWS charges continue after credits are exhausted. This means the engineer must understand cost controls, resource cleanup, monitoring, and billing alerts.
Use the Paid Plan when:
- You need access to services not included in the Free Plan
- You are building larger or longer-running labs
- You need AWS Organizations
- You are practicing multi-account architecture
- You are comfortable managing AWS costs
AWS Organizations Credit Gotcha
One of the most important gotchas from this lesson is the relationship between Free Tier credits and AWS Organizations.
If a Free Plan account is upgraded manually to the Paid Plan, remaining Free Tier credits continue to apply to future bills until they expire. However, AWS states that if the account is upgraded by joining AWS Organizations or setting up AWS Control Tower, remaining Free Tier credits expire immediately and the account becomes ineligible to earn more Free Tier credits.
This matters for SAP-C02 because AWS Organizations is a major exam topic. Multi-account strategy is a best practice, but the account lifecycle and billing implications still matter.
Required Information for AWS Account Setup
To create an AWS account, you generally need:
- A unique email address
- A unique AWS account name
- A root user password
- A valid payment method
- A phone number for identity verification
AWS requires a valid payment method even for the Free Plan, but AWS states the payment method is not charged unless the account is upgraded to the Paid Plan.
For lab accounts, using email aliases can help organize accounts. For example, a Gmail-style alias such as name+aws-lab@example.com can route to the same inbox while still being treated as a unique email address by AWS.
Root User vs IAM User
When an AWS account is first created, the initial identity is the AWS account root user. The root user has complete access to the account and should not be used for normal administrative work.
AWS recommends avoiding root user access unless a task specifically requires root credentials. The root user should be protected with a strong password, MFA, secure email access, and careful recovery controls. AWS also recommends not creating access keys for the root user.
For daily work, use IAM identities, IAM Identity Center, roles, and least-privilege permissions instead of logging in as root.
AWS Console Region Awareness
When logging into the AWS Management Console, AWS may place the user in a default or geographically nearby Region. For training, many labs use us-east-1, also called US East (N. Virginia).
This matters because AWS is Regional. Creating resources in the wrong Region can cause confusion, unexpected costs, and troubleshooting issues. Some services are global, but many services such as EC2, RDS, VPC, and ELB are Region-specific.
Billing Alarms and Cost Controls
Paid Plan accounts require active cost monitoring. At minimum, an engineer should understand:
- AWS Budgets
- CloudWatch billing alarms
- Billing and Cost Management
- Service-specific pricing
- Resource cleanup after labs
- Forecasted versus actual costs
AWS Budgets can track AWS cost and usage and support cost monitoring across accounts. CloudWatch billing alarms can notify when estimated charges exceed a defined threshold, but AWS billing metric data is stored in US East (N. Virginia), and billing alerts must be enabled.
Exam-Relevant Takeaways
For SAP-C02, the account signup process itself is not likely to be tested in detail. The exam-relevant material is the architecture and governance thinking around accounts.
Remember these points:
The AWS Free Plan is safer for beginners because it prevents surprise charges unless the account is upgraded.
The AWS Paid Plan is required for unrestricted service access, long-term usage, and many advanced architecture labs.
AWS Organizations is central to enterprise AWS design, but joining an Organization or setting up Control Tower can immediately expire remaining Free Tier credits for new accounts.
The root user is not a normal admin account. It should be secured, protected with MFA, and used only for root-required tasks.
Billing controls are part of operational excellence. A professional-level architect should design for cost visibility, budget alerts, account isolation, tagging, and governance.
Region awareness is important. Resources created in the wrong Region can lead to confusion, cost issues, and broken lab assumptions.
Architecture Decision Guide
| Scenario | Best AWS Choice | Why |
|---|---|---|
| Beginner wants to explore AWS with minimal billing risk | AWS Free Plan | Limits service access and avoids charges unless upgraded |
| Student needs AWS Organizations, Route 53 domain registration, or advanced services | AWS Paid Plan | Provides access to the full service catalog and production-style features |
| Account has remaining Free Tier credits and will later use AWS Organizations | Manually upgrade to Paid Plan before using Organizations | Helps preserve remaining credits instead of losing them through automatic upgrade behavior |
| Long-term lab or portfolio environment | AWS Paid Plan with Budgets and alerts | Free Plan expires after six months or credit exhaustion |
| Enterprise multi-account strategy | AWS Organizations / AWS Control Tower | Enables centralized governance, account management, and policy controls |
| Daily administrative access | IAM user, IAM role, or IAM Identity Center | Avoids routine use of the root user and supports least privilege |
| Initial account owner access | Root user | Created during account setup, but should be secured and rarely used |
| Cost monitoring for estimated charges | CloudWatch billing alarm or AWS Budgets | Provides notification when spending approaches a threshold |
Common Exam Traps
Do not assume the Free Plan provides access to every AWS service. It provides selected services and features.
Do not assume Free Tier credits mean there is no cost risk in a Paid Plan. Once credits are exhausted, billable usage continues.
Do not choose root user access for normal administration. The root user is for account-level tasks and emergency/root-only operations.
Do not ignore AWS Organizations in account planning. It is the preferred enterprise multi-account model, but it can affect Free Tier credit handling for new accounts.
Do not forget Region selection. Creating resources in the wrong Region is a common real-world mistake and can cause lab failures or unexpected costs.
Do not rely only on manual cleanup. Use budgets, billing alerts, tags, automation, and account-level governance where appropriate.
Real-World Engineer Notes
In a real environment, the Paid Plan is the expected model for anything beyond beginner learning. The Free Plan is useful for controlled experimentation, but enterprise architecture requires services such as AWS Organizations, IAM Identity Center, centralized logging, networking, Route 53, security tooling, and governance controls.
For a professional setup, the first-day account checklist should include securing the root user, enabling MFA, creating administrative access through IAM or IAM Identity Center, setting up cost alerts, choosing a default Region strategy, and documenting the account purpose.
For MSP or consulting work, account naming and email strategy matter. A clean naming convention helps prevent confusion later when managing multiple customers, lab environments, or sandbox accounts.
For cost governance, treat AWS like any other consumption-based platform. Shutting down EC2 instances may not eliminate all charges if EBS volumes, snapshots, NAT gateways, Elastic IPs, load balancers, RDS instances, or Route 53 hosted zones remain active.
For troubleshooting, always verify the account, Region, identity, and billing state before assuming a service issue. Many AWS “problems” are actually caused by being in the wrong account, wrong Region, wrong role, or using a service unavailable under the current account plan.
Quick Reference Summary
AWS has two main new account plan choices: Free Plan and Paid Plan.
Free Plan is safer for beginners because it prevents surprise charges unless upgraded.
Paid Plan gives access to the full AWS service catalog and allows usage beyond credit thresholds.
New customers can receive $100 in credits and may earn up to another $100.
Free Plan accounts expire after six months or credit exhaustion.
Remaining credits can carry forward after a manual upgrade to Paid Plan.
Joining AWS Organizations or setting up Control Tower can immediately expire remaining Free Tier credits.
Root user is created during account setup but should not be used for daily administration.
Secure root with MFA and avoid root access keys.
Set up billing alarms or AWS Budgets early.
Use us-east-1 when required for billing alarms and when labs specify that Region.
Flashcards
Q: What are the two main AWS account plan options for new customers?
A: AWS Free Plan and AWS Paid Plan.
Q: What is the main benefit of the AWS Free Plan?
A: It provides a safer learning environment by preventing charges unless the account is upgraded to the Paid Plan.
Q: What happens when a Free Plan account exhausts its credits?
A: The Free Plan account expires or becomes inaccessible unless upgraded to the Paid Plan.
Q: How long does the Free Plan last?
A: Up to six months or until Free Tier credits are exhausted, whichever comes first.
Q: Why might a student need the Paid Plan?
A: Some services and features, such as AWS Organizations or Route 53 domain registration, may require Paid Plan access.
Q: What is the AWS Organizations credit gotcha?
A: If a Free Plan account is upgraded through AWS Organizations or Control Tower, remaining Free Tier credits can expire immediately.
Q: What should you do before using AWS Organizations if you want to preserve remaining credits?
A: Manually upgrade the account to the Paid Plan first.
Q: What identity is created when an AWS account is first opened?
A: The AWS account root user.
Q: Should the root user be used for daily administration?
A: No. Use IAM identities, IAM roles, or IAM Identity Center for normal administration.
Q: What is one critical security control for the AWS root user?
A: Enable MFA and protect the root user credentials.
Q: Why is Region selection important in AWS labs?
A: Many AWS resources are Regional, and creating resources in the wrong Region can cause confusion, lab failures, or unexpected cost.
Q: What service can be used to track AWS cost and usage against thresholds?
A: AWS Budgets.
Q: Where is AWS billing metric data stored for CloudWatch billing alarms?
A: US East (N. Virginia), also known as us-east-1.
Q: Why is AWS billing different from traditional fixed-cost infrastructure?
A: AWS uses consumption-based pricing, so costs depend on what resources are created, how long they run, and what supporting services remain active.
Practice Questions
Question 1:
A solutions architect is creating a new AWS account for short-term study labs and is concerned about accidentally generating charges. The labs do not require AWS Organizations or advanced services outside the Free Plan. Which account plan is the best initial choice?
A. Paid Plan with no billing alarms
B. Free Plan
C. AWS Organizations management account
D. AWS Control Tower landing zone
Correct Answer:
B. Free Plan
Explanation:
The Free Plan is designed for safer learning and helps prevent surprise charges unless the account is upgraded. It is appropriate for short-term labs that only need supported Free Plan services.
Question 2:
A student has a new AWS Free Plan account with remaining Free Tier credits. They need to start using AWS Organizations for multi-account labs but want to avoid losing remaining credits. What should they do first?
A. Join an AWS Organization immediately
B. Create an AWS Control Tower landing zone first
C. Manually upgrade the account to the Paid Plan before using AWS Organizations
D. Delete the account and create a new Free Plan account
Correct Answer:
C. Manually upgrade the account to the Paid Plan before using AWS Organizations
Explanation:
AWS states that upgrading through AWS Organizations or Control Tower can cause remaining Free Tier credits to expire immediately. Manual upgrade preserves remaining credits until their normal expiration.
Question 3:
A new AWS account has just been created. Which identity exists by default and should be secured immediately?
A. IAM Identity Center user
B. IAM role
C. AWS account root user
D. AWS Organizations delegated administrator
Correct Answer:
C. AWS account root user
Explanation:
The root user is created during account setup and has full account access. It should be secured with MFA and used only for root-required tasks.
Question 4:
A solutions architect wants to receive notifications when estimated AWS charges exceed a configured threshold. Which solution matches this requirement?
A. Create a CloudWatch billing alarm after enabling billing alerts
B. Create an S3 lifecycle policy
C. Configure an EC2 Auto Scaling policy
D. Create a Route 53 health check
Correct Answer:
A. Create a CloudWatch billing alarm after enabling billing alerts
Explanation:
CloudWatch billing alarms can notify when estimated AWS charges exceed a threshold. Billing metrics are stored in us-east-1.
Question 5:
A lab guide says to use US East (N. Virginia), but the user accidentally creates resources in another Region. What is the most likely operational issue?
A. The root user will be disabled
B. The account will automatically convert to the Free Plan
C. The lab may not work as expected, and resources may be harder to find or clean up
D. AWS Organizations will delete the resources
Correct Answer:
C. The lab may not work as expected, and resources may be harder to find or clean up
Explanation:
Many AWS services are Regional. Creating resources in the wrong Region can cause confusion, failed lab steps, and unexpected ongoing charges.