Can I just use an IAM user with access keys for learning?

It works, but long-lived keys are a common source of leaks. Identity Center with short-lived credentials is safer and is what AWS recommends for people. If you do use keys, never commit them and delete them when finished.

Why does the AWS CLI say I have no credentials or the wrong account?

Usually the SSO session expired or a different profile is active. Run aws sso login for your profile and check with aws sts get-caller-identity.

AWS Getting Started: Secure Your Account, Set Up Access, and Use the CLI

Introduction

The first steps in AWS matter more than they look: how you secure the account and how you sign in set the foundation for everything after. This lesson follows AWS's recommended approach: protect the root user, use IAM Identity Center for daily access instead of long-lived keys, set a budget, and verify everything with the AWS CLI.

Prerequisites

An email address and payment method for an AWS account
The cost and security lessons recommended

Step-by-Step Guide

Step 1: Create the account and secure the root user

The email you sign up with becomes the root user, which has unrestricted power over the account. Turn on multi-factor authentication for it immediately, and AWS recommends registering more than one MFA device as a backup. Do not create access keys for the root user, and use it only for the few tasks that truly require it.

Step 2: Set up daily access with IAM Identity Center

For day-to-day work, AWS recommends signing in through IAM Identity Center rather than as the root user or with long-lived IAM user access keys. Enable it in the console, create a user for yourself, assign that user permissions through a permission set, and sign in through the access portal URL it gives you. Use only the permissions you need, even in your own account.

Step 3: Create a budget

Open Billing and Cost Management and create a monthly cost budget with email alerts at several thresholds. Do this before you create any resources. Free-tier and credit terms for new accounts have changed over time, so read the current offer for your account instead of relying on older articles.

Step 4: Install the AWS CLI and sign in with SSO

Install AWS CLI version 2 from the AWS documentation, then configure a named profile that signs in through your Identity Center. The configure command asks for your portal URL, region, and the account and role to use, and the login command opens a browser to authenticate with short-lived credentials.

aws --version

aws configure sso          # follow the prompts; name the profile, e.g. dev
aws sso login --profile dev

Step 5: Verify who you are

The sts get-caller-identity call is the safest first command: it changes nothing and shows which account and identity your credentials map to. Use it whenever you are unsure which account or profile is active, and always pass or export the profile you intend to use.

aws sts get-caller-identity --profile dev

# make the profile the default for this terminal session
# macOS / Linux
export AWS_PROFILE=dev
# Windows (PowerShell)
# $env:AWS_PROFILE = "dev"

FAQs

Can I just use an IAM user with access keys for learning?: It works, but long-lived keys are a common source of leaks. Identity Center with short-lived credentials is safer and is what AWS recommends for people. If you do use keys, never commit them and delete them when finished.
Why does the AWS CLI say I have no credentials or the wrong account?: Usually the SSO session expired or a different profile is active. Run aws sso login for your profile and check with aws sts get-caller-identity.

Summary

Enable MFA on the root user and stop using it, sign in daily through IAM Identity Center, set a budget, and confirm your identity with aws sts get-caller-identity before creating anything.