Cloud Account Setup: The First Hour After Approval

Most setup guides jump straight to launching a server. The account itself
deserves an hour first, because several of these items are trivial now and
genuinely unpleasant to retrofit onto an account with real infrastructure in
it.

Secure the root credentials, then stop using them

The account you registered with is the most powerful identity you will ever
have on the platform. It can close the account, change billing and remove any
restriction placed on anything else.

Turn on multi-factor authentication for it immediately. Then, on platforms
that support separate users, create an administrative user for yourself and use
that for daily work. The root credentials should become something you use
rarely and deliberately, which also means storing them somewhere you will still
have access to in two years.

Set billing alerts before you deploy anything

Doing this before the first instance exists means the alert is in place
during exactly the period when mistakes are most likely. Set a budget at the
figure you expect, with notifications below it, at it and above it.

Point the notifications at an address a person actually reads. The
registration address is often a mailbox nobody opens. The full procedure is in
set up billing alerts before you deploy
anything.

Check what the free allowance actually covers

Find out, specifically, what your credit or free tier includes, which
resource sizes qualify, and the date it expires. Put that date in a calendar
with a reminder a week before.

This matters because the usual free tier accident is not overspending; it is
choosing an instance one size above the qualifying size and being billed in full
from the start. What each platform offers is set out in the
free tiers comparison.

Decide a naming and tagging convention now

It takes five minutes to decide that resources will be named by project,
environment and role, and that each will carry tags recording the project and
the owner. It takes an afternoon to apply that to fifty existing resources, and
nobody ever does.

The payoff arrives the first time you look at an invoice and want to know
which project is responsible for a charge, as discussed in
reading a cloud invoice.

Set your default region deliberately

Consoles default to a region that may be nowhere near you or your users.
Resources created in a forgotten default region are the classic source of
charges nobody can account for later. Set it once, deliberately, using the
reasoning in choosing a region.

Upload an SSH key to the account

Adding your public key at account level means every instance you create can
have it installed automatically, and no machine ever needs password
authentication enabled. This is a better starting position than disabling
passwords afterwards. See
SSH keys vs passwords.

Add a second contact, and check the first one works

Providers send security notices, suspension warnings and billing problems to
the registered address. If that address is a personal mailbox belonging to one
person, a holiday becomes a single point of failure.

Add an alternate or security contact where the platform supports it, and send
yourself a test from the console to confirm messages arrive and are not being
filtered as spam.

Read the acceptable use policy, briefly

You do not need to study it. You do need to know whether what you intend to
run is permitted, because the common surprises are specific and worth checking
in advance: outbound email on port 25, which is blocked by default nearly
everywhere, cryptocurrency mining, and running public network scanning. The
reasoning on email is in
port 25 and outbound email.

A compact checklist

1. Multi-factor authentication on the root identity.
2. An administrative user for daily work.
3. Budget and billing alerts, pointed at a monitored inbox.
4. Free tier scope and expiry date recorded.
5. Naming and tagging convention decided.
6. Default region set deliberately.
7. SSH public key uploaded.
8. Secondary contact added and delivery tested.
9. Acceptable use policy skimmed for anything that affects your plan.

That is an hour, most of it reading. Everything on it is harder later.