Working on AWS: Workloads, Account Security, Management and Cost Control
What teams actually run on AWS, the security steps to take in a new account, the management habits that keep it tidy, and how AWS pricing models fit together.
Amazon Web Services offers more than 200 services, which makes the platform feel enormous on day one. In practice, most teams use a familiar core: compute, storage, managed databases, networking and a growing set of AI services. This guide walks through what people actually build on AWS, the security steps every new account needs, the management habits that keep an account organized, and how the AWS pricing models fit together. If you are new to the platform, start with our overview of AWS core services and come back here when you are ready to run real workloads.
What you can build with an AWS account #
AWS groups its catalog into service families. The table below lists the ones that show up in nearly every architecture and what each family is for.
| Area | Services | What they do |
|---|---|---|
| Compute and virtual servers | Amazon EC2 | Virtual machines with instance types for general-purpose, compute-optimized, memory-intensive and GPU workloads, including AI training |
| Storage | Amazon S3, EBS, EFS, S3 Glacier | Durable object storage, block volumes for instances, shared file systems and long-term archive tiers |
| Managed databases | Amazon RDS, Aurora, DynamoDB, ElastiCache, Redshift | Relational, NoSQL, caching and warehouse engines with backups, patching, replication and scaling handled by AWS |
| Machine learning and AI | SageMaker, Bedrock, Rekognition, Comprehend, Polly | Model training and hosting, foundation models through one API, and prebuilt vision, language and speech services |
| Content delivery and networking | CloudFront, Route 53, VPC, API Gateway | Global CDN, DNS, isolated private networks and managed API endpoints |
| Serverless | Lambda, Fargate, EventBridge | Run functions and containers without managing servers, wired together with an event bus |
| DevOps and CI/CD | CodeCommit, CodeBuild, CodeDeploy, CodePipeline | Source hosting, builds, deployments and release pipelines |
| Analytics and big data | EMR, Kinesis, Athena, Glue | Cluster processing, streaming ingestion, SQL over S3 and data cataloging or ETL |
| Security and identity | IAM, Cognito, Shield, WAF | Permissions, user sign-in for apps, DDoS protection and a web application firewall |
How different teams use AWS #
Developers and freelancers
Developers use AWS to test applications in a real cloud environment rather than on a laptop. A common pattern is one account (or one account per client) so that projects stay isolated, billing is easy to read, and experiments with new services never touch production. AWS Organizations makes it straightforward to run separate sandbox, staging and production accounts under one bill.
Businesses and startups
Startups value the ability to prototype, test and deploy quickly, then scale the same services as usage grows. Established businesses commonly keep separate accounts for testing, development, staging and disaster recovery so that no one has to compromise the production environment to try something new.
Agencies and consultancies
Agencies usually need a separate AWS environment per client, with isolated billing and distinct security configurations. The supported way to do that is for each client to own their account and grant the agency access through IAM roles, which keeps a clean separation between clients and a professional hand-over when the engagement ends.
Researchers and data scientists
Simulations, model training and large dataset processing need GPU instances, big data clusters and analytics tools. Pay-as-you-go pricing suits research well because there is no long-term commitment, and Spot Instances can cut the cost of interruptible batch jobs substantially.
AI development
AI workloads draw on GPU instances, high-memory compute and managed services for the full lifecycle, from data preparation and feature engineering to training, deployment and monitoring. Amazon Bedrock adds foundation models from several AI companies behind a single API, so teams can build generative AI features without managing model infrastructure. Our guide to AWS AI services covers each of them in turn.
Securing a new AWS account #
Security starts with how you run the account itself. The steps below are the standard baseline and take less than an hour.
- Protect the root user. Give the root user a long, unique password and enable multi-factor authentication. Then stop using it for daily work.
- Create IAM users or roles. Give each person or workload an identity with only the permissions their role needs, rather than sharing root access.
- Set up AWS Budgets and billing alerts so unexpected charges are flagged early. Our guide to budgets and billing alerts shows where these live.
- Review security groups and network ACLs so only required inbound and outbound traffic reaches your resources.
- Enable AWS CloudTrail to log API activity across the account. This is your audit trail for security reviews and compliance.
- Turn on Security Hub for a consolidated view of security findings across services.
- Audit regularly. Review configurations and access logs on a schedule, and remove access that is no longer needed.
Account management essentials #
- Resource organization: tag resources by project, environment or department and group them with resource groups. Tags are what make cost allocation possible later.
- Cost monitoring: review the billing dashboard regularly and use Cost Explorer and Budgets to track usage patterns.
- Access control: apply least privilege through IAM policies, and prefer roles over long-lived access keys.
- Backup and recovery: automate backups for critical data and test the restore procedure, not just the backup job.
- Compliance monitoring: AWS Config and Security Hub can check the account continuously against security best practices and regulatory frameworks.
- Documentation: keep a record of the account structure, configurations and procedures so new team members can be onboarded quickly.
For organizations running several accounts, AWS Organizations provides consolidated billing and shared policies. Note that AWS promotional credits are generally applied to a specific account and are not transferable between accounts, so plan where credits should land before you apply them.
How AWS pricing works #
AWS is pay-as-you-go: you pay for the services you use, with several ways to lower the unit price in exchange for commitment or flexibility.
| Model | How it works | Best for |
|---|---|---|
| On-Demand | Pay for compute by the hour or second with no commitment | Unpredictable or short-lived workloads |
| Reserved Instances | Commit to an instance type for one or three years for a significant discount | Steady-state servers that will run for years |
| Spot Instances | Use spare EC2 capacity at a large discount; instances can be interrupted | Batch jobs, rendering, CI, fault-tolerant processing |
| Savings Plans | Commit to a consistent amount of usage per hour for lower prices, with flexibility across instance families | Teams that want commitment discounts without locking in instance types |
| Free Tier | New accounts may qualify for limited free usage of certain services for a limited period | Learning and small experiments |
Our guide to how AWS billing works goes into the Free Tier and Savings Plans in more detail, and cloud pricing models compared shows how these models line up against other providers.
Keeping AWS costs under control
- Set AWS Budgets with alerts at thresholds that matter to you.
- Check Cost Explorer weekly until you know what a normal month looks like.
- Right-size instances to the workload instead of leaving development defaults in place.
- Use Auto Scaling so capacity follows demand rather than peak estimates.
- Move predictable workloads onto Reserved Instances or Savings Plans.
- Delete unused resources: idle instances, unattached EBS volumes, old snapshots and forgotten load balancers all bill quietly.
Official references #
The AWS documentation covers every service mentioned here, and the IAM and CloudTrail user guides are the right starting points for account security. Our AWS platform overview summarizes how the platform is organized and how to sign up officially.
Frequently asked questions #
What services can I use with an AWS account?
A standard AWS account gives access to the full catalog, including EC2, S3, RDS, Lambda, SageMaker and Bedrock. Some services and instance types are subject to default service quotas that can be raised through a quota increase request in the console.
How do I manage an AWS account day to day?
Through the AWS Management Console for a web interface, or the AWS CLI and SDKs for scripted and programmatic management. Most teams use the console to explore and the CLI or infrastructure-as-code tools for anything repeatable.
What is the single most important security step?
Enable multi-factor authentication on the root user and then create IAM identities for everyday work. Almost every serious AWS account compromise starts with an unprotected root login or a leaked long-lived access key.
