AWS Free Tier for Cloud Practitioner: Practical Labs

Before starting, open Billing and Cost Management and review your account plan, credit balance, credit expiry and any Free Tier usage information available. AWS changed its Free Tier programme for new customers on 15 July 2025. Newer accounts use a credit-based programme with Free and Paid account plans; accounts created before that date follow legacy eligibility rules. Under the newer programme, the Free account plan lasts up to six months and can end earlier when credits run out. Legacy introductory allowances also expire. Check the [official AWS Free Tier page](https://aws.amazon.com/free/) rather than assuming an older tutorial describes your account.

Under the newer programme, the Free account plan does not charge you unless you upgrade to the Paid account plan, but it restricts available services and ends when its time or credit limit is reached. Do not upgrade merely to complete a lab. Paid-plan and legacy accounts can incur charges outside applicable credits or allowances. Enable any Free Tier usage notifications available for your account, and configure an AWS Budget with a low actual-cost threshold and a forecast notification where supported. Check the email recipients carefully. Budgets and billing data can update after usage occurs: notifications are warnings, not real-time spending caps.

Start with AWS Identity and Access Management, or IAM, which has no additional charge for its core users, groups, roles and policies. Secure the root user with multi-factor authentication and avoid using it for routine lab work. AWS recommends temporary credentials for human access, commonly through IAM Identity Center; follow the current AWS setup guidance appropriate to your account. Once you have suitable administrative access, open IAM and inspect an AWS-managed read-only policy. Identify its Effect, Action and Resource elements. This shows how authorisation works without deploying a workload or making a resource publicly accessible.

For a small practical exercise, create a customer-managed policy that allows only s3:ListAllMyBuckets with Resource set to an asterisk. Name it clearly as a temporary lab policy and leave it unattached. This action lists bucket names; it does not grant permission to read objects. Explain why an Allow in this policy would still be subject to other applicable controls and explicit denies. Then delete the policy through IAM. An unattached policy grants no permissions, but removing it keeps the account tidy. Do not create access keys, change root permissions or delete existing identities merely to complete this exercise.

Amazon S3 provides object storage and is useful for learning the difference between buckets, objects and permissions. Before creating a bucket, check whether your account has applicable S3 credits or allowances and review storage, request and transfer pricing. Create a general purpose bucket in your chosen Region, using a unique name without personal information. Keep all S3 Block Public Access settings enabled and keep ACLs disabled. Leave versioning off for this exercise and use the default server-side encryption with Amazon S3 managed keys, rather than introducing an AWS KMS key. Upload one small text file containing only dummy content.

Open the object's details and identify its key, size, storage class and encryption setting. A prefix can make an object key look like a folder path, but S3 is not a traditional file system. Optionally download the tiny file once to observe a read operation, recognising that requests and data transfer can affect billing. Do not enable static website hosting, replication or optional analytics features. To clean up, delete the object and then delete the empty bucket. If you accidentally enabled versioning, remove all object versions and delete markers as well; a simple delete can leave billable stored versions behind.

AWS Lambda lets you practise serverless computing without provisioning an EC2 instance. Check Lambda eligibility and pricing alongside Amazon CloudWatch Logs pricing, because logging is a separate service. Create a function from scratch in your chosen Region using a currently supported Python runtime. Keep the code minimal: a handler that returns a short greeting and prints one line is enough. Use a basic execution role with only the permissions needed to write logs. Do not attach the function to a VPC, create a function URL or add an event trigger. Use a short timeout and the smallest memory setting suitable for this trivial function.

Invoke the function manually once or twice with a small test event, then inspect its result, duration and CloudWatch log stream. Notice that a test event invokes code; it does not automatically create an HTTP application. If available, set reserved concurrency to one to limit simultaneous executions, but remember that this does not cap total invocations or spending. Avoid loops, recursion and scheduled triggers. Afterwards, delete the function, its dedicated CloudWatch log group and the execution role if nothing else uses it. Deleting the function alone does not remove retained logs or its IAM role. Remove any other dedicated resources you created accidentally.

Finish with a resource audit rather than assuming that closing the browser stops usage. Revisit S3, Lambda, CloudWatch Logs and IAM, checking every Region you used for regional resources. Verify that your bucket, function, log group and temporary IAM resources are gone. If you explored beyond the instructions, look specifically for running instances, storage volumes, snapshots, public IPv4 addresses, NAT gateways and load balancers. These can have independent billing implications, and stopping a compute instance does not necessarily remove associated storage or networking costs. Do not delete unfamiliar resources in a shared account; ask the account owner to identify them.

Return to Billing and Cost Management after usage data has had time to appear, then check again later for delayed updates. Review consumption of credits as well as the amount currently payable: a zero balance due does not mean you created no metered usage. Record which resources you created, how you removed them and which billing dimensions applied. For useful aws training revision, explain why S3 is object storage, Lambda is serverless compute, IAM controls authorisation and CloudWatch provides monitoring capabilities. These explanations connect hands-on observations to CLF-C02 concepts without mistaking console familiarity for complete exam preparation.