Lesson 040 · AWS Learning Path

AWS 040: AWS account, cost, and tooling foundation

Anil Jalela · Published Aug 4, 2025 · 6 min read

Purpose

This checkpoint verifies that the personal AWS account is safe enough for later practical work and that the learner can use Console, CloudShell, local CLI, and SDK context without confusing identity, Region, permission, output, or pagination.

Passing requires evidence. A list of definitions is insufficient.

Required submission

Submit tooling-checkpoint.md plus redacted artifacts from AWS 024 through AWS 039. Do not include account IDs, principal ARNs, email addresses, telephone numbers, payment data, credentials, MFA material, or raw debug logs.

Critical safety gates

Every item must pass:

• root MFA enabled;
• no root access keys;
• separate daily non-root identity;
• daily identity uses MFA or approved federation;
• billing budget and notification path active;
• security, operations, and billing contacts current;
• fixed course Region documented;
• temporary local CLI authentication used;
• no secret in evidence or shell history;
• no unnecessary resource or quota changes.

A failed safety gate blocks progression regardless of score.

Task 1: account ownership and recovery

Explain and provide redacted evidence for:

1. root use cases;
2. root MFA and recovery resilience;
3. absence of root access keys;
4. protected root mailbox and phone recovery path;
5. daily identity separation;
6. what happens if the primary MFA device is lost.

Do not perform a destructive recovery test.

Task 2: cost protection

Open Billing and Cost Management and record:

• current account plan;
• Free Tier or credit state;
• relevant expiry;
• course-monthly-cost budget status;
• actual and forecast thresholds;
• verified notification;
• last review time.

Then answer:

1. Why can a Paid plan receive charges even with credits?
2. Why is a budget not a circuit breaker?
3. Why can billing data and alerts be delayed?
4. What retained resources can continue charging after compute deletion?
5. Which page begins a charge investigation?

Use current account values, not values copied from course text.

Task 3: contact readiness

Use the contact matrix from AWS 026. For each contact type, give one sample notice, first response, escalation owner, and quarterly review date.

Scenario: an email claims an access key was exposed and asks the learner to sign in through a shortened link. Describe the safe verification and containment sequence without clicking the link or sending credentials.

Task 4: Console and Region

In the Console:

1. prove non-root identity type;
2. select the fixed course Region;
3. open EC2 instance inventory;
4. open VPC inventory;
5. open IAM;
6. explain which views are regional and which are account/global;
7. compare one read-only page in a second Region;
8. return to the course Region.

Explain why an empty EC2 page does not prove the account has no instances anywhere.

Task 5: CloudShell

Open standard CloudShell and run:

pwd
whoami
aws --version
aws configure list
aws sts get-caller-identity --output json --no-cli-pager

Explain what each command proves and what it does not prove. Confirm that whoami is a Linux user, while get-caller-identity returns AWS identity context.

Record CloudShell Region and intended workload Region. If they differ, explain why and how --region scopes a command.

Task 6: local CLI

On Linux prove:

• CPU architecture;
• AWS CLI v2 version;
• executable path;
• all discovered AWS CLI paths;
• course profile;
• temporary authentication method;
• resolved credential source;
• fixed Region;
• logout behavior.

The learner must explain installer provenance, why the archive was validated, what sudo did, and why installation did not prove AWS access.

Task 7: three-interface comparison

Use Console, CLI, and the Python SDK to report:

• principal type;
• Region;
• Availability Zone names;
• Availability Zone IDs.

All interfaces must match. If one differs, diagnose account, principal, Region, provider, filter, and pagination before correcting it.

Explain why application code should use an SDK rather than parse human-formatted CLI table output.

Task 8: API safety

For a mutating request that times out after reaching AWS:

1. explain why success or failure may be ambiguous;
2. classify the error before retry;
3. show how a supported client token or business idempotency key prevents duplicate effect;
4. define maximum attempts and elapsed time;
5. specify verification and audit evidence;
6. explain why a new random token on every retry is wrong.

No mutating request is executed.

Task 9: infrastructure placement

Draw:

partition -> Region -> Availability Zones
                    -> Local Zone where applicable
edge service -> points of presence -> regional origin

For the training portal:

• choose a primary Region;
• place application capacity across at least two AZs;
• identify cacheable edge content;
• keep assessment writes on the controlled transactional path;
• state a recovery Region requirement;
• explain zone IDs across accounts;
• identify data transfer and replication consequences.

Task 10: responsibility and governance

Compare customer and AWS responsibility for EC2, RDS, and S3 across:

• physical infrastructure;
• operating system;
• engine/platform;
• identity;
• network exposure;
• encryption;
• data;
• backup and restore;
• availability design;
• monitoring;
• cost.

Then provide the approved course tagging keys, prohibited tag data, naming format, and read-only tag compliance method.

Task 11: quota and support

Record:

• one regional quota;
• one global quota;
• applied value and usage if visible;
• headroom calculation;
• adjustability;
• expected lead time and owner.

Select Basic, Business Support+, Enterprise Support, or Unified Operations for:

1. this personal learning account;
2. a 24/7 revenue application needing business-critical technical response;
3. a large critical portfolio needing named strategic guidance.

Use current AWS plan documentation, not historical names.

Task 12: controlled troubleshooting

Reproduce or review the AWS 039 failures:

• missing profile;
• environment profile precedence;
• invalid Region;
• denied or inapplicable read operation;
• artificially limited pagination.

For each give symptom, exit code, error stage, cause, smallest correction, and retest. The final known-good preflight must succeed.

Scoring

Pass requires 85 overall, at least 70 percent in each area, and every critical safety gate.

Oral defense

The reviewer selects four actions from the evidence:

• one root-security decision;
• one CLI command;
• one architecture decision;
• one troubleshooting correction.

For each, the learner explains purpose, parameters, success evidence, failure evidence, scope, cost, and cleanup or retained state.

Remediation

Failed work is corrected with a new scenario:

1. identify the failed competency;
2. remove unsafe evidence immediately;
3. revisit the source lesson and official documentation;
4. produce corrected evidence;
5. explain the original error;
6. repeat the oral defense;
7. record retest outcome.

Do not solve a permission failure by using root or attaching broad administrator access.

Completion gate

Pass when the score reaches 85, every safety gate passes, the final non-root account/Region preflight is correct, cost and contact controls remain active, and the learner independently defends all four selected actions.

Retain the secure account baseline, contacts, budget, fixed Region record, approved CLI profile, and private evidence. Remove obsolete tokens, temporary installers, and unsafe transcripts.

Official sources

• AWS root user best practices
• AWS Budgets
• AWS CloudShell
• AWS CLI configuration
• AWS global infrastructure
• AWS Shared Responsibility Model
• Service Quotas