AWS Registration and IAM Setup.

This article covers signing up for AWS and creating users with IAM.

AWS.

IAM.

I also use a separate account created with IAM that has permission to run instances.

All of the above is configured using the separate account I created.

For anyone reading AWS documentation for the first time, IAM is one of those things that leaves you wondering 'what is this?' — I couldn't quite understand why it was necessary until I actually started using it.

In this article, I'll cover IAM — the feature that manages the separate account with execution permissions, set up after registering with AWS.

AWS Basic Setup.

Since Lightsail is one of AWS's services, you'll need an AWS account to use it.

First, register with AWS and create an account.

1. Open https://aws.amazon.com/ and click "Create a Free Account" in the upper right of the page.
2. The AWS sign-up page will open.
3. Enter the email address you want to use as your root user email, and enter a new account name.
4. Click "Verify email address."
5. Continue through the sign-up flow and enter contact information including personal/business type, name, address, and phone number.
6. Enter your credit card information.
7. After completing sign-up, a 4-digit verification code will be sent to your phone via SMS.
8. Enter the verification code and then select a support plan from the options shown.
9. Once sign-up is complete, the AWS console will open.
10. Configure your login password and two-factor authentication settings.

This completes your AWS account creation. This account is what's referred to as the root account from this point forward.

After registering with AWS, you need to use IAM — the user management feature — to set up the user that will actually use AWS services. IAM stands for AWS Identity and Access Management, and it's the feature that configures each user's permissions for AWS services (referred to as "resources" in AWS terminology).

A basic principle of AWS is that the person who registered the account is recognized as the "root" — a user with full privileges. For personal use, the same person who registered will be building the website, but you still need to set up a separate user with access to all AWS services, equivalent to the registrant.

The reason for this is both security and the need for emergency access — if the account used for day-to-day work becomes inaccessible, there needs to be a way to access the service and recover. This emergency role is assigned to the root account, which holds full privileges. By keeping actual system-building work in a separate account and reserving the root account for emergencies, AWS separates the working account from the all-privileged account, addressing both security and emergency recovery.

Below is a summary of the concepts behind the AWS root account and the IAM account.

1. AWS registration and billing setup: the registrant becomes the root account.
2. Using IAM with the root account to create a "non-root execution account with execution permissions."
3. In the diagram above, the root account is referred to as "Takeda_Admin."
4. The account created with IAM becomes the account used for all AWS work going forward.
5. The IAM account used for actual AWS work is referred to as "Takeda_iam01."
6. Sign in to "https://<12-digit account>.signin.aws.amazon.com/console" as "Takeda_iam01."
7. From here, Lightsail and Drupal are installed going forward.

Reference: Amazon Web Service Login

Following this process, you create the account you'll use for day-to-day AWS work with IAM. That account is then used to install and configure the instances you need on AWS.

Viewed from the outside, IAM's purpose is hard to grasp, but once you actually use it, you can see how well thought-out it is — both for security and for emergency access.

At its core, IAM is designed for teams using AWS together — managing permissions per person involved in system development and administration. It's an instance with the features to manage large-scale development or system environments.

Below are links to the official guides for AWS registration and IAM covered in this article.

AWS Official Guide

1. AWS account creation > Billing and user management
2. IAM execution user setup > Installing and configuring each instance

With this in place and the execution user created, the AWS account now has everything needed to install Drupal on Lightsail.

Conclude.

By registering with AWS and following AWS's guidance to create a separate IAM account for actual use — distinct from the root account — I came to understand what IAM does, what it means, and why it's necessary. With the IAM execution account now set up and ready to run AWS instances, the next article covers selecting Lightsail and installing Drupal.