Everything in AWS belongs to an account, identified by a twelve-digit number. Resources, bills and permissions all hang off it.

The root user

The person who creates an account signs in with its email address. That is the root user. Root can do anything, including closing the account, and nothing can restrict it. So the first thing a careful team does is lock root away: a strong password, MFA (a code from a phone or a hardware key as a second proof), no access keys, and a note of the few tasks that genuinely need it.

Day to day, nobody uses root. People and programs get their own identities instead. In this account an administrator identity called admin already exists, with MFA; it is the one your CloudShell uses. Chapter 2 explains how such identities work.

Who am I?

aws sts get-caller-identity

{
    "UserId": "AIDAEXAMPLEUSERID12345",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/admin"
}

sts is the service that hands out credentials, and this is its "who am I" question. Three facts come back: the identity's id, the account, and its ARN, the Amazon Resource Name. ARNs are the full names of things in AWS; you will read and write them constantly. This one says: in the iam service, in account 123456789012, the user named admin.

Run this command whenever a result surprises you. A great many "AWS is broken" moments are "I am not who I thought I was".

Account facts

aws iam get-account-summary
aws iam list-account-aliases

The summary is a long list of counts. One line matters today: "AccountMFAEnabled": 1 means the root user has MFA; 0 means it does not. An alias gives the account a readable name next to its number, handy when you have several.