Labs · Cyber Security

Lab: Secure a New AWS Account: Root MFA, No Root Keys, an Admin IAM User with MFA, a CloudTrail Trail and a Zero-Spend Budget

By Ravindra Bagale · Last updated: 8 October 2026

Suppose we are…

Suppose we have just joined Zepto as a cloud engineer, and a new AWS account was opened for a hackathon team. Before anyone launches anything, the security lead hands us a first-day checklist: root MFA, no root access keys, an admin IAM user with MFA for daily work, an activity log (CloudTrail) and a billing alarm. We practise it on our own AWS account.

Goal of this lab

By the end you will have:

• MFA on the root user and proof that root has no access keys.
• An IAM user admin-<yourname> with AdministratorAccess and its own MFA.
• A CloudTrail trail recording management events, a zero-spend budget, and green ticks in IAM's security recommendations.

What you need (all free)

• Your own AWS account (Lab 4) and the root email and password.
• An authenticator app on your phone. About 40 minutes.
• Cost: ₹0. One CloudTrail trail of management events is free; its S3 logs are tiny. Do not enable KMS encryption on the trail (step 11), because a KMS key costs about $1 per month.

Part 1: lock the root user

1. Sign in at https://console.aws.amazon.com as Root user with your email and password.
2. Click your account name (top right) → Security credentials. Under Multi-factor authentication (MFA) click Assign MFA device.

3. Device name root-phone, choose Authenticator app → Next. Scan the QR code with your phone, type two consecutive codes → Add MFA.

   👁 What you should see: your device listed under MFA with type Virtual.

4. On the same page scroll to Access keys.

   👁 What you should see: no access keys. If one exists, click Actions → Deactivate, then Delete. The root user should never have keys.

Part 2: an admin user for daily work

5. Open IAM → Users → Create user. User name admin-yourname, tick Provide user access to the AWS Management Console, choose I want to create an IAM user, set a custom password from your password manager → Next.
6. Choose Attach policies directly, tick AdministratorAccess → Next → Create user. Copy the Console sign-in URL shown.
7. Open IAM → Dashboard. Under AWS Account copy the Sign-in URL for IAM users, and save it in your password manager with the new user.
8. Sign out of root. Open the sign-in URL and log in as admin-yourname.

9. Add MFA for this user too: IAM → Users → admin-yourname → Security credentials → Assign MFA device → same steps as step 3, name admin-phone.

   👁 What you should see: at the top right, admin-yourname @ 1234-5678-9012, not your root email.

Part 3: activity log and money alarm

10. Open CloudTrail → Event history. AWS already keeps 90 days of management events here for free. Filter Event name = ConsoleLogin.

    👁 What you should see: your sign-ins from steps 1 and 8, with time, user and source IP.

11. Create a trail so events are kept longer: CloudTrail → Trails → Create trail. Name account-trail, Create new S3 bucket (keep the suggested name), untick Log file SSE-KMS encryption, keep Log file validation enabled → Next → Management events, Read and Write → Next → Create trail.

12. Open Billing and Cost Management → Budgets → Create budget → Use a template → Zero spend budget. Enter your email → Create budget. (If you made one in Lab 4, just confirm it exists.)

13. Open IAM → Dashboard → Security recommendations.

    👁 What you should see: green ticks for Root user has MFA and Root user has no active access keys.

14. From now on use only admin-yourname. Write down which few tasks still need root (for example changing the account's support plan or closing the account), and keep the root password and MFA in a safe place.

Common mistakes

Self-check checklist

Try-at-home challenge

In CloudTrail Event history, find the event that created your IAM user and the one that attached AdministratorAccess. Which user performed them and from which IP?

Clean up to avoid charges

1. Keep root MFA, the admin user, its MFA and the zero-spend budget: they are free and keep you safe.
2. The trail is free for management events, and its S3 logs cost almost nothing. If you want zero storage: CloudTrail → Trails → account-trail → Delete, then S3 → the aws-cloudtrail-logs-… bucket → Empty → Delete. Event history (90 days) stays.
3. If you accidentally created a KMS key: KMS → Customer managed keys → select it → Key actions → Schedule key deletion → 7 days.
4. Next month open Billing and Cost Management → Bills and confirm ₹0.

Samjla ka? Root locked, admin with MFA, CCTV on, money alarm set. Aata pudhe jaauya: Chapter 31 reads logs like a SOC analyst.