World map

 

BM

World A1: Renting a Unit · Boss challenge

A safe first day

You will learn: to open an account safely: root locked, MFA on, a budget alarm before anything else.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Boss: Kedai Kancil opens its real AWS account today. The keys are brand new. What comes first?

Try it

Room 1: plan the whole first day. Put it in a safe order.

First step at the top. Put these in order. Use the arrows, or drag.

  • Create a zero spend budget
  • Switch on IAM access to billing
  • Sign up: the root user is born
  • Only now, build something small
  • Sign out of root; sign in as the admin
  • Make an everyday admin sign-in, with MFA
  • Add MFA to the root user

Try it

Room 2: Kancil’s teammates have ideas. Safe, or needs work?

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Keep a second MFA device in the office safe.

Try it

Room 3: set the alarm from the terminal. Build the command.

Tap the pieces in the right order.

…

Watch

bash
aws sts get-caller-identity
{
"UserId": "AIDASAMPLEUSERID",
"Account": "123456789012",
"Arn": "arn:aws:iam::123456789012:user/DevAdmin"
}

Room 4: before any change, ask who you are. The Arn ends in user/DevAdmin: an everyday admin, not root.

Predict

One day the Arn ends in :root instead. What should Kancil do?

Check

Room 5: a teammate built a test, then “turned it off”. Which leftovers still bill?

One at a time: does it keep costing money while it sits idle?

1 of 6

Disk (EBS volume) of a stopped instance

On the bill (costs even when idle)

Nothing here yet.

Free shelf (free when idle)

Nothing here yet.

Try it

Final room, for real: your own safe first day. No resources, no cost.

Real mission

  7. aws sts get-caller-identity

0 of 7 steps done · Your ticks are saved.

You did it!

You can now open an AWS account safely: root locked, alarm on.