How to secure an AWS Root account and create an admin user with access to Billing Information
Tags: aws, tutorial, beginners, security
Published: 2020-07-29 23:53:58

---
title: How to secure an AWS Root account and create an admin user with access to Billing Information
description: A root user on AWS can access everything that AWS offers. Let us see how we can create a user with administrator and Billing Access rights so that we can reduce the number of reasons why we would need to log in as a root user
published: true
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/ixuvfodif59ey7lsozez.png
date: 2020-07-25 00:00:00 UTC
tags: aws, tutorial, beginners, security
canonical_url: https://www.ankursheel.com/blog/secure-aws-root-account-create-admin-user-access-billing
---

When you first create your AWS account, you create a root user. A root user can access everything that AWS offers and you cannot reduce the permissions associated with it. Amazon best practices recommend that you can create an admin group for administrative tasks. However, IAM users do not have access to the _AWS Billing and Cost Management Console_ by default so we need to explicitly enable access.

Let's see how we can create a user with administrator and Billing Access rights so that we can reduce the number of reasons of why we would need to login as a root user.

First login as the root user

## Enable Access to Billing Informations for IAM users

On the navigation bar, choose the account name and click on _My Account_.

![My Account](https://dev-to-uploads.s3.amazonaws.com/i/zgqtqbfh6xvd0pnbdzlv.png)

### Enable Access to Billing Information

![Activate IAM Access](https://dev-to-uploads.s3.amazonaws.com/i/e1pte19q67ss1i4c4t41.png)

In the _IAM User and Role Access to Billing Information_ section select the _Activate IAM Access_ checkbox and click on the _Update_ button.

## Secure root user

Navigate to the IAM(Identity and Access Management) console.

![IAM Service](https://dev-to-uploads.s3.amazonaws.com/i/ixuvfodif59ey7lsozez.png)

-   Activate MFA on the root account to secure it.

-   Change the sign-in link to be more friendly by clicking on the _Customize_ button.
    ![Customize Sign-in Link](https://dev-to-uploads.s3.amazonaws.com/i/6bw1alxxywpzkhqkyc18.png)

## Add User with Administrator Rights

Click on the _User_ item in the navigation pane and then click the _Add User_ button.

![Manage Users](https://dev-to-uploads.s3.amazonaws.com/i/90wtmx314gqc90htt1d9.png)

### Set User Details

![Add user](https://dev-to-uploads.s3.amazonaws.com/i/413uoeu9eo0g2mq1v561.png)

-   Add the username eg _user_.
-   Select the _Programmatic Access_ and _AWS Management Console Access_ checkboxes.
-   Select _Autogenerated password_ for _Console Password_.
-   Select the _Require Password Reset_ checkbox.
-   Click the _Next: Permissions_ button.

### Set Permissions

![Set Permissions](https://dev-to-uploads.s3.amazonaws.com/i/qnbsp4w42bgx6sf1x0da.png)

-   Select the _Add user to group_ item.
-   Click on the _Create group_ button.

### Create Admin Group

![Create Admin group](https://dev-to-uploads.s3.amazonaws.com/i/p6q0r5ctwetg40m25nc6.png)

-   Add the group name. eg _Admin_.
-   Select the _AdminstratorAccess_ policy from the list of the policies.
-   Click _Create Group_. This will take you back to the _Set Permissions_ screen.

### Add user to Admin group

![Add user to Admin Group](https://dev-to-uploads.s3.amazonaws.com/i/bf842vhct72782uopcq7.png)

-   Select the Admin group that you just created.
-   Click on _Next: Tags_.

### Add tags

Adding tags is optional so we will skip tags

![Add Tags](https://dev-to-uploads.s3.amazonaws.com/i/whb4gg9ip378mrzq31lj.png)

Click on _Next: Review_.

### Review User

![Add User review](https://dev-to-uploads.s3.amazonaws.com/i/e9gtee7vy1vg3cvaj4m5.png)

Review the settings and if everything is correct, press the _Create user_ button.

### Download Credential Information

![User Access Keys](https://dev-to-uploads.s3.amazonaws.com/i/dgd8ikymmymfn9rg1jv9.png)

Once the user has been created, you can download the credential information. Remember, that this will be the only time
you can access this information.

## Create a group and policy for accessing Billing Service

Click on the _Policies_ item in the navigation pane and then click the _Create Policy_ button
![Create Policy](https://dev-to-uploads.s3.amazonaws.com/i/mqp40y8cs0zwzfyfot3x.png)

### Add Billing Service

![Create Policy](https://dev-to-uploads.s3.amazonaws.com/i/v0ws021zi0k8fgk2qdg2.png)

In the _Select a service_ section, search for _Billing_ and then select _Billing_.

### Add Allowed Actions for Billing Policy

![Add allowed actions](https://dev-to-uploads.s3.amazonaws.com/i/128tcjvwqz4r5d1lli0c.png)

-   Select the _All Billing actions_ checkbox.
-   Click on the _Review policy_ button.

### Create Billing Policy

![Create Billing Policy](https://dev-to-uploads.s3.amazonaws.com/i/6hsseqoxegqqyqw0ieko.png)

-   Add the name for the policy eg _BillingFullAccess_.
-   Click the _Create Policy_ button.

### Create Billing Group

![Create Billing Group](https://dev-to-uploads.s3.amazonaws.com/i/5gvllpnkk69gr0dgre7d.png)

Click on the _Groups_ item in the navigation pane and then click the _Create New Group_ button.

### Set group name

![Set Group Name](https://dev-to-uploads.s3.amazonaws.com/i/8o9j5fvkamen6wucvw5a.png)

-   Give a name for the Billing group eg _BillingFullAccess_.
-   Click on the _Next Step_ button.

### Attach Policy

![Attach Billing Policy](https://dev-to-uploads.s3.amazonaws.com/i/e4m78z1ary8nafpgdw7m.png)

-   Search for _Billing_ in the filter.
-   Select the _BillingFullAccess_ policy checkbox.
-   Click on the _Next Step_ button.

### Review Group

![Review](https://dev-to-uploads.s3.amazonaws.com/i/6nwkk44g5xhze6r36ppz.png)

-   Click the _Create Group_ button.

## Add User to the Billing Group

![Select User](https://dev-to-uploads.s3.amazonaws.com/i/cavotqajpi8wwqjd00mc.png)

Click on the _Users_ item in the navigation pane and then click the user that you want to add to the group.

### Groups

![Select Group](https://dev-to-uploads.s3.amazonaws.com/i/brvmewwavfgrf27gl7qk.png)

Select the _Groups_ tab.

### Add user to group

![Add User to group](https://dev-to-uploads.s3.amazonaws.com/i/rfxwgjiym4sin6dvs9uk.png)

Click on the _Add User to Group Button_.

### Select Billing group

![Select Billing Group](https://dev-to-uploads.s3.amazonaws.com/i/8p3xnitr217xof8i7sjc.png)

-   Select the _BillingFullAccessGroup_ checkbox.
-   Click on the _Add to Groups_ button.

## Conclusion

We now have an IAM user that has administrator rights for our AWS account and also has full access to the AWS Billing and Cost Management Console. Its also easy to give other users access to either Administrator rights or Billing rights.