Lab: using cloud free tiers safely (budgets, MFA, clean-up)

Aim and what you need

The aim is to prepare a personal cloud account so you can practise without two common disasters: a stolen login used to run expensive resources, and a forgotten resource quietly billing you for months. The free offers differ by provider and change over time. Typically you get a time-limited credit for new accounts plus some services that are free up to a monthly limit. Read the current terms on the provider's own pages before you start, and note the end date in your calendar.

• A dedicated email address for the cloud account, not shared with anything else.
• A payment card (required for sign-up by most providers). A prepaid or virtual card with a low limit adds protection.
• An authenticator app or a hardware security key.
• Optional: the AWS CLI, Azure CLI or Google Cloud CLI on your computer.

Steps

1. Sign up, then immediately turn on MFA (multi-factor authentication) for the root user (AWS), the owner account (Azure) or your Google account. A passkey or hardware key is best.
2. Create a budget with alerts at 50%, 80% and 100% of a small amount, following the budget alerts lab. On AWS, also turn on free tier usage alerts in billing preferences.
3. Stop using the root or owner login for daily work. Create an admin identity with MFA, as in the AWS IAM and MFA lab.
4. Pick one region close to you and use it for every lab.
5. Put every lab into something you can delete in one go: an Azure resource group, a Google Cloud project, or on AWS a CloudFormation stack, a Terraform folder, or at least a project=lab tag.
6. At the end of every session, delete what you built, then run the inventory commands below.

aws resourcegroupstaggingapi get-resources --tag-filters Key=project,Values=lab --query "ResourceTagMappingList[].ResourceARN"
for r in $(aws ec2 describe-regions --query "Regions[].RegionName" --output text); do echo $r; aws ec2 describe-instances --region $r --query "Reservations[].Instances[].[InstanceId,State.Name]" --output text; aws ec2 describe-addresses --region $r --query "Addresses[].PublicIp" --output text; done
aws ec2 describe-nat-gateways --query "NatGateways[?State=='available'].NatGatewayId"

az resource list --output table
az group delete --name rg-lab-week1 --yes --no-wait
gcloud projects list
gcloud projects delete <lab-project-id>

How to verify

You are set up correctly when the security page of each account shows MFA as active for the owner, a test budget alert email has arrived (set one temporarily to a tiny amount if needed), and your inventory commands return nothing after clean-up. The next day, open the billing or cost page and confirm that today's charges are zero or match what you expected. Remember that billing data lags by several hours, and budgets warn you but do not stop spending.

Common money traps and clean-up

If you get a surprise charge, delete the resource first, then contact the provider's billing support; they will sometimes help first-time learners. When you finish with the platform, close the account properly rather than abandoning it.