Skip to content
GoHackersCloud Academy

Lesson 05 — Securing a New AWS Account

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 01 – AWS Security Foundations

🎯 Lesson Objective

Section titled “🎯 Lesson Objective”

By the end of this lesson, you will be able to:

  • Secure a brand-new AWS account.
  • Configure enterprise security baseline controls.
  • Protect the Root User.
  • Configure Multi-Factor Authentication (MFA).
  • Create an Administrator IAM User.
  • Configure Billing Alerts.
  • Enable CloudTrail.
  • Review IAM Account Settings.
  • Prepare your AWS account for future modules.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Beginner

Prerequisites: Lessons 01–04

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Section titled “💼 Business Value”

Whenever a company creates a new AWS account, the Cloud Security team is responsible for preparing it before developers begin deploying workloads.

This process is known as establishing a Security Baseline.

A properly secured AWS account reduces the risk of:

  • Account compromise
  • Unauthorised access
  • Misconfigurations
  • Unexpected costs
  • Compliance failures

This lesson simulates that onboarding process.

🏢 In the Company

Section titled “🏢 In the Company”

CloudNova Technologies has opened a new AWS account for its Development environment.

The Cloud Engineering team wants immediate access.

Before approving the account, the CISO requires you to complete the Enterprise Security Baseline.

Only after this checklist is complete can developers begin using AWS.

🏗 Enterprise Build

Section titled “🏗 Enterprise Build”

Throughout the remainder of this learning path, you will continue securing this same AWS account.

Today’s goal is to create a secure foundation.

Future lessons will add:

  • IAM
  • VPC
  • CloudTrail
  • GuardDuty
  • Security Hub
  • KMS
  • AWS Config
  • Inspector
  • WAF
  • Incident Response

Everything begins here.

📋 Enterprise Security Baseline

Section titled “📋 Enterprise Security Baseline”

By the end of this lesson you will have completed:

✅ Root Account Protected

✅ MFA Enabled

✅ Administrator IAM User

✅ Billing Alerts

✅ CloudTrail Enabled

✅ Password Policy Reviewed

✅ IAM Account Summary Reviewed

✅ AWS CLI Configured

🧪 Enterprise Mission 01 — Sign in to AWS

Section titled “🧪 Enterprise Mission 01 — Sign in to AWS”

Open:

https://console.aws.amazon.com

Sign in using your Root User.

🧪 Enterprise Mission 02 — Secure the Root Account

Section titled “🧪 Enterprise Mission 02 — Secure the Root Account”

Navigate to

Account


↓


Security Credentials

Review

  • Root Email
  • Password
  • MFA
  • Access Keys

Verify Root Access Keys

Section titled “Verify Root Access Keys”

Ensure:

No Root Access Keys Exist

If access keys exist:

Delete them.

Root access keys should never be used.

🧪 Enterprise Mission 03 — Enable MFA

Section titled “🧪 Enterprise Mission 03 — Enable MFA”

Navigate

Security Credentials


↓


Multi-Factor Authentication


↓


Assign MFA Device

Supported methods

  • Authenticator App
  • Hardware Key
  • FIDO Security Key

Recommended:

Microsoft Authenticator

or

Google Authenticator

Verify

MFA Enabled

🧪 Enterprise Mission 04 — Create an Administrator User

Section titled “🧪 Enterprise Mission 04 — Create an Administrator User”

Navigate

IAM


↓


Users


↓


Create User

Example

cloud-admin

Enable

Provide Console Access

Assign

AdministratorAccess

Note: We use AdministratorAccess only during the initial learning phase. Later lessons will replace this with least-privilege custom policies.

🧪 Enterprise Mission 05 — Sign in as IAM User

Section titled “🧪 Enterprise Mission 05 — Sign in as IAM User”

Sign out of Root.

Sign in using

IAM User

Verify:

  • Console Access
  • MFA
  • Permissions

Root account should no longer be used for daily work.

🧪 Enterprise Mission 06 — Configure AWS CLI

Section titled “🧪 Enterprise Mission 06 — Configure AWS CLI”

Verify installation

Terminal window
aws --version

Expected

aws-cli/2.x.x

Configure

Terminal window
aws configure

Example

AWS Access Key ID:


AWS Secret Access Key:


Default Region:


Default Output Format: json

Verify

Terminal window
aws configure list

Current identity

Terminal window
aws sts get-caller-identity

🧪 Enterprise Mission 07 — Review IAM Account Summary

Section titled “🧪 Enterprise Mission 07 — Review IAM Account Summary”
Terminal window
aws iam get-account-summary

Review

  • Users
  • Groups
  • Roles
  • MFA Devices
  • Account Alias

🧪 Enterprise Mission 08 — Create an Account Alias

Section titled “🧪 Enterprise Mission 08 — Create an Account Alias”

Console

IAM


↓


Dashboard


↓


Create Account Alias

Example

cloudnova-dev

This makes sign-in easier.

Verify using CLI:

Terminal window
aws iam list-account-aliases

🧪 Enterprise Mission 09 — Configure Billing Alerts

Section titled “🧪 Enterprise Mission 09 — Configure Billing Alerts”

Navigate

Billing


↓


Billing Preferences

Enable

  • Receive Billing Alerts

Go to

CloudWatch


↓


Alarms


↓


Create Alarm

Configure:

  • Billing Metric
  • Threshold
  • Email Notification

Example:

Threshold Purpose
₹500 Learning account budget
₹1000 Warning threshold
₹2000 Immediate investigation

🧪 Enterprise Mission 10 — Enable CloudTrail

Section titled “🧪 Enterprise Mission 10 — Enable CloudTrail”

Navigate

CloudTrail


↓


Create Trail

Configuration

Trail Name


cloudnova-trail

Choose

Multi-Region Trail


Enabled

Enable

Management Events


Read & Write

Store logs in

New S3 Bucket

CLI Verification

Terminal window
aws cloudtrail describe-trails

🧪 Enterprise Mission 11 — Review Password Policy

Section titled “🧪 Enterprise Mission 11 — Review Password Policy”

Console

IAM


↓


Account Settings

Review

  • Minimum Length
  • Numbers
  • Symbols
  • Uppercase
  • Lowercase

CLI

Terminal window
aws iam get-account-password-policy

🧪 Enterprise Mission 12 — Verify Account Security

Section titled “🧪 Enterprise Mission 12 — Verify Account Security”

Run

Terminal window
aws iam get-account-summary

Run

Terminal window
aws sts get-caller-identity

Run

Terminal window
aws configure list

Confirm

✅ IAM User

✅ MFA

✅ CLI

✅ CloudTrail

🏢 Enterprise Scenario

Section titled “🏢 Enterprise Scenario”

CloudNova has completed the AWS account setup.

Before approving production access, the CISO asks you to verify:

  • Root account is protected
  • MFA is enabled
  • Developers are not using the Root User
  • Billing alerts are configured
  • CloudTrail is recording API activity
  • AWS CLI is configured for administrators
  • Security baseline documentation is complete

Prepare a recommendation for approval.

📊 Knowledge Check

Section titled “📊 Knowledge Check”
  1. Why should the Root User rarely be used?
  2. Why is MFA mandatory?
  3. Why should administrators use IAM Users?
  4. Why are billing alerts important?
  5. Why enable CloudTrail before deploying resources?
  6. What information does aws sts get-caller-identity provide?
  7. What is the purpose of an IAM Account Alias?
  8. Why should Root Access Keys never exist?
  9. Which AWS CLI command verifies your current configuration?
  10. What is a Security Baseline?

📝 Assignment

Section titled “📝 Assignment”

Create an AWS Security Baseline Document for CloudNova Technologies.

Include:

  • AWS Account Information
  • Root User Protection
  • MFA Configuration
  • IAM Administrator User
  • Billing Alert Configuration
  • CloudTrail Configuration
  • CLI Configuration
  • Security Checklist
  • Screenshots of completed tasks
  • Recommendations before production deployment

Length: 4–5 pages

✅ Lesson Completion Checklist

Section titled “✅ Lesson Completion Checklist”

Before continuing, verify that you have completed every task.

Task Status
Root Account Secured ☐
Root Access Keys Removed ☐
MFA Enabled ☐
Administrator IAM User Created ☐
Signed in as IAM User ☐
AWS CLI Configured ☐
IAM Account Alias Created ☐
Billing Alerts Configured ☐
CloudTrail Enabled ☐
Password Policy Reviewed ☐
Security Baseline Document Created ☐

💡 Key Takeaways

Section titled “💡 Key Takeaways”

After completing this lesson, you should be able to:

  • Secure a new AWS account using enterprise best practices.
  • Protect the Root User and enforce MFA.
  • Create and use an Administrator IAM User instead of the Root User.
  • Configure the AWS CLI for secure administration.
  • Enable CloudTrail to capture account activity.
  • Configure billing alerts to monitor costs.
  • Establish a repeatable security baseline for future AWS accounts.

📚 Further Reading

Section titled “📚 Further Reading”
  • AWS IAM Best Practices
  • AWS CloudTrail User Guide
  • AWS Billing and Cost Management Documentation
  • AWS CLI User Guide
  • AWS Well-Architected Framework – Security Pillar

🚀 Next Lesson

Section titled “🚀 Next Lesson”

➡️ Lesson 06 — AWS Security Services Overview