The AWS Management Console is the web interface from which you see and govern everything you have in the cloud. Marta and Luis are going to keep it open in a tab throughout the whole MercadoFresco project, so it is worth devoting a full lesson to it: not a sightseeing tour of the menus, but the things that genuinely get used day to day and, above all, the traps that cost beginners hours and money.

By the end you will know how to move around confidently, you will understand why the region selector in the top right corner is the most dangerous element on the whole screen, you will know how to tag resources so that you can find them and control their cost later, and you will have created, tagged, located and deleted your first real resource in the MercadoFresco account.

1. What the console is and when it is the right tool
2. Signing in: IAM user versus root user
3. The top bar, element by element
4. The region trap and how to avoid it
5. Console Home, favourites and the service search box
6. Tags: the habit that saves the bill
7. Resource Groups and Tag Editor: finding what you have scattered
8. AWS CloudShell: a terminal with nothing to install
9. Billing, Cost Explorer and Trusted Advisor: where they live
10. Switching roles between accounts
11. Guided exercise: create, tag, locate and delete a bucket

The console is a web client that calls the same APIs the CLI and the SDKs use. There is nothing the console can do that the API cannot (the reverse does happen: some operations are available through the API only).

It helps to be clear about what each tool is for:

The professional rule: explore in the console, build with code. Everything that reaches production should be defined in CloudFormation or CDK, not created by hand. But for learning and for investigating an incident, the console is irreplaceable.

There are two different sign-in forms, and confusing them is common at the start.

At MercadoFresco, Marta keeps the IAM user's direct link in the password manager, and only that one. If on signing in you see a red banner warning you that you are using root, sign out and sign back in as mercadofresco-admin.

A useful trick: the console lets you have several sessions at once if you use your browser's session profiles (Chrome, Firefox and Edge all support them). That way you can keep the development account open in one profile and production in another, without signing in and out constantly. It is a cheap way of avoiding the classic "I thought I was in development".

The top bar is present on every screen. From left to right:

This section deserves its own space because it is, by a wide margin, the most frequent mistake made by people starting out on AWS.

As we saw in lesson 01-03, almost every resource is regional or zonal. The console creates resources in whichever region is selected at that moment, and that selection:

• Is stored per browser and per user, not per account.
• Can revert to us-east-1 if you open the console from a link in the documentation.
• Gives you no warning at all when you create something in the wrong region.

Luis creates an EC2 instance on a Thursday. On Monday he comes back, opens the console from a link in a tutorial (which takes him to us-east-1), goes to EC2 and sees an empty list. He concludes it "deleted itself" and creates another one. The following month the bill has two instances: the Irish one and the Virginia one, both switched on and both charging.

1. Look at the region before every creation. Make it a reflex, like checking the mirror.

2. Pin the default region. In Console Home, the settings widget lets you choose the region that loads when you sign in. Set it to eu-west-1.

3. Check the URL. The console includes the region in the address; it is an instant giveaway:

   https://eu-west-1.console.aws.amazon.com/ec2/home?region=eu-west-1
                                                           ^^^^^^^^^
   

4. Use the Tag Editor to search across all regions when something "does not show up" (we look at it in a moment).

5. Review the bill by region. In Billing → Bills, the per-region breakdown gives away any resource forgotten in an unexpected place.

And remember the exception from lesson 01-02: billing alarms live in us-east-1. If you are going to create one, switch region deliberately and switch back afterwards.

This is the landing screen. It is made up of widgets that you can add, remove and reorder by dragging. The genuinely useful ones:

Marta sets up her Console Home with Cost and usage, AWS Health and Recently visited at the top: the three things she wants to see every morning.

Click the search bar (or press Alt+S) and start typing. The search box returns four kinds of result:

• Services: type s3, ec2, iam.
• Specific features within a service: type buckets, security groups, snapshots.
• Your own resources: type the name or ID of a resource (i-0a1b2c3d, fotos-producto).
• Documentation and blog posts.

Searching is almost always faster than navigating the services menu. Get into the habit of using it.

When you open a service, click the star next to its name to pin it to the favourites bar. For the MercadoFresco course, this initial selection is a good starting point:

Favourites are stored per user, so Luis and Sara will have their own.

A tag is a key-value pair you attach to a resource. They do nothing on their own: they change neither the behaviour nor the performance of the resource. But they are the only practical way to answer questions such as:

• Which resources are production and which are test?
• How much does the "product catalogue" part cost us per month?
• Who created this, and who do I ask before deleting it?
• What can be switched off overnight without breaking anything?

Without tags, in six months you will have a list of resources with cryptic names and nobody will dare delete any of them "just in case". That is money thrown away every month.

From day one Marta defines a minimal, mandatory scheme:

Hygiene rules that spare you a lot of grief:

• Keys are case-sensitive: Entorno and entorno are different tags and will break your reports. Fix a convention and stick to it.
• A maximum of 50 tags per resource; keys up to 128 characters, values up to 256.
• Do not put sensitive data in tags. They are visible in billing and in many reports.
• The aws: prefix is reserved and you cannot use it.

Almost every service offers a Tags tab on the resource detail screen, with a Manage tags or an Add tags button. On top of that, most creation wizards include a tagging step of their own: always use it, because tagging at the moment of creation is the only habit that survives the passage of time.

Note: for tags to appear broken out in cost reports you have to activate them as cost allocation tags in the billing console, and they take up to 24 hours to show up. That full procedure is lesson 11-02.

When you have resources of several types spread across several regions, each service's own console falls short: EC2 shows you instances, S3 shows you buckets, but nobody shows you "everything belonging to the MercadoFresco project".

That is what Resource Groups & Tag Editor is for.

It is a cross-cutting search screen. It searches:

• All regions at once (the All regions option).
• All resource types (the All supported resource types option).
• Filtering by tag key and value.

It is the tool that solves the wrong-region problem: if something "has vanished", search in Tag Editor with All regions and it will turn up.

It also lets you edit tags in bulk: you select 30 resources and add Proyecto=mercadofresco to all of them in one go. It is how you fix a careless tagging job without dying of boredom.

A resource group is a saved query. Instead of repeating the search every time, you save it with a name and always have it to hand.

MercadoFresco creates two groups from the outset:

The second is especially valuable: it is the list of everything that can be switched off on a Friday night so you do not pay for the weekend.

Groups can be tag based (a query over tags, the usual case) or CloudFormation stack based (all the resources created by a template, module 9).

AWS CloudShell is a Linux command interpreter that opens inside the browser, from the terminal icon on the top bar. It is one of the best additions the console has had in the last few years.

Its virtues:

• It comes already authenticated. It automatically inherits the permissions of the user you signed in with: there are no credentials to configure and no keys to copy anywhere.
• It ships with the tools preinstalled: AWS CLI v2, Python with boto3, Node.js, git, jq, vim.
• It persists 1 GB in your home directory, per region, between sessions.
• It is free. You only pay for whatever the resources you create from there consume.

Its limits:

• The session closes after roughly 20-30 minutes of inactivity.
• The storage is wiped if you do not use CloudShell in that region for 120 days.
• It is only available in some regions (eu-west-1 is one of them).

Try it straight away: open CloudShell and run

Expected output:

What each field means:

• UserId: the user's internal identifier.
• Account: the 12-digit ID of your account (the one you noted down in 01-02).
• Arn: the Amazon Resource Name, the unique, global identifier of that identity. You will see ARNs everywhere in AWS; their structure is explained in lesson 04-01.

That command is the best way to answer "which permissions am I acting with right now?". You will use it a lot. The CLI in depth —local installation, profiles, filtering— is lesson 01-05.

Three places worth locating now, even though we study them thoroughly later on.

Account menu → Billing and Cost Management. Inside:

Remember that Billing is a global service: the region selector does not affect it.

This is the spend analysis tool: charts by day or by month, grouped by service, region, instance type or tag. That is where MercadoFresco's tagging scheme starts to pay off: you will be able to see how much the catalogo component costs compared with pedidos.

When you first enable it, it takes up to 24 hours to have data. Enable it today even if you do not need it yet. Using it fully is lesson 11-03.

Search box → Trusted Advisor. It is a service that analyses your account and gives you recommendations in five categories: cost, performance, security, fault tolerance and service limits.

On the Basic support plan you will only see a subset of the checks (basic security ones and limits). With Business or Enterprise all of them are unlocked. Even with the free subset it is worth a look: it detects things like public S3 buckets or root MFA not being enabled. We cover it in depth in lesson 05-05.

In the account menu there is a Switch role option. It lets you move to another AWS account, or to another set of permissions within the same one, without signing out: you enter the target account ID and the role name, and the console "lends" you that identity.

It is the standard mechanism in companies with several accounts (one for development, one for production, one for security). The last five roles used are saved with a colour, which helps you see at a glance where you are: at many companies production is deliberately painted red.

MercadoFresco still has a single account, so we will not use it for now. The multi-account strategy is studied in lesson 09-04 (AWS Organizations) and the permissions that make it possible in 04-01 (IAM).

Let us handle the console for real. We will use an S3 bucket as the pretext because it is the simplest resource to create and delete; S3 in depth is lesson 02-03.

Cost: an empty bucket costs nothing, and the Free Tier covers 5 GB for 12 months. Even so, we will delete it at the end to build the habit.

1. Sign in as mercadofresco-admin (not as root).
2. Look at the region selector in the top right and select Europe (Ireland) eu-west-1.
3. Confirm in the URL that region=eu-west-1 appears.

1. Type S3 in the search box and open the service.

2. Click Create bucket.

3. Bucket name: bucket names are globally unique, so add something of your own:

   mercadofresco-pruebas-consola-<your-initials>-<4-digits>
   

   For example: mercadofresco-pruebas-consola-jc-2741. Lower case, digits and hyphens only.

4. Region: Europe (Ireland) eu-west-1.

5. Leave Block all public access ticked. It is the default and you should never untick it without a very specific reason: most of the "AWS leaks" you have heard about are buckets with this box unticked.

6. Scroll down to the Tags section and add:

   Key	Value
   Proyecto	mercadofresco
   Entorno	pruebas
   Componente	formacion
   Propietario	your name

7. Click Create bucket.

1. Type Resource Groups in the search box and open Resource Groups & Tag Editor.
2. In the side menu, click Tag Editor.
3. Set up the search:
   • Regions: select All regions.
   • Resource types: All supported resource types.
   • Tags: key Proyecto, value mercadofresco.
4. Click Search resources.

Your bucket should appear, with its type, its region and its tags. Note that you found it without knowing which region it was in: that is exactly the tool that solves the problem of the wrong region.

1. In the side menu, Create resource group.
2. Type: Tag based.
3. Grouping criteria: all resource types, tag Proyecto=mercadofresco.
4. Group name: mercadofresco-todo.
5. Create.

You now have that query saved and one click away.

Open CloudShell from the top bar and run:

Line by line:

• aws s3api: S3's low-level interface, which exposes every API operation (aws s3 is the simplified, high-level interface).
• get-bucket-tagging: the operation that returns the tag set.
• --bucket: the name of the bucket we are asking about.

Expected output:

That is how you confirm that the console and the API are two sides of the same thing.

1. Go to S3 → Buckets.
2. Select the bucket and click Delete.
3. S3 will ask you to type the exact bucket name to confirm. It is a deliberate protection against accidental deletions.
4. Confirm.

If the bucket had objects inside it, you would first have to empty it with the Empty button. A bucket that is not empty cannot be deleted.

Optionally, delete the mercadofresco-todo resource group as well (it costs nothing, but it leaves the account tidy).

• Creating resources in the wrong region. Already hammered home, but it is the mistake you will make most often. Always look at the selector before clicking Create.
• Working as root "because that way there are no permission problems". If you see the root banner, get out.
• Not tagging "because it is a temporary resource". Almost every temporary resource ends up permanent. Always tag at the moment of creation: nobody does it afterwards.
• Using Entorno and entorno interchangeably. Keys are case-sensitive. An inconsistent scheme ruins your cost reports and raises no error at all, so the problem is discovered months later.
• Unticking Block all public access when creating a bucket. Do not do it unless you know exactly what you are doing. To serve public content there is CloudFront (lesson 03-04), which does not require opening up the bucket.
• Looking for a resource only in its own service console. If it does not appear, try Tag Editor with All regions before concluding that it does not exist.
• Believing that deleting a resource in the console deletes everything. Terminating an EC2 instance can leave EBS volumes, Elastic IPs and snapshots billing. Always review what is attached.
• Tip: use browser profiles to separate accounts. It is safer and faster than signing out and back in.
• Tip: learn the search shortcut (Alt+S). Navigating menus is slow; searching by name is instant.
• Tip: whatever you do in the console and want to keep, write down. When you reach module 9 you will turn those notes into CloudFormation templates.

Without creating any new resource, answer using the console alone:

1. What is your account's 12-digit ID and what alias does it have?
2. Which identity are you acting as right now? Obtain the full ARN by two different routes: through the console and through CloudShell.
3. How much have you spent this month, and on which services?
4. How many Trusted Advisor checks do you have available and how many are raising an alert?
5. Do you have any resource in a region other than eu-west-1? Prove it with Tag Editor.

Within a few months MercadoFresco is going to have: shop servers, an orders database, a bucket of product photos, a function that calculates delivery routes, and a full development environment that Luis wants to switch off at weekends.

1. Write out the tagging scheme you would apply to each of those five items, using the keys defined in this lesson.
2. Define three resource groups that Marta would find useful and explain what question each one answers.
3. What tag would you add to the scheme to automate the overnight shutdown of the development environment, and what values would it have?

Sara points out that this month's bill has a $9 EC2 charge, but Marta goes into the EC2 console and sees no instances. What is more, both swear that nobody has created anything.

1. List, in order, the steps you would take in the console to track down the source of the charge.
2. Name at least three possible causes of an EC2 charge with no visible instances.
3. Which two preventive measures from this lesson and from 01-02 would have prevented the problem or detected it sooner?

Solution 1

1. Account menu (top right): the 12-digit ID appears there and, below it, the alias. Also in IAM → Dashboard.
2. Through the console: IAM → Users → mercadofresco-admin, the ARN field, in the form arn:aws:iam::111122223333:user/mercadofresco-admin. Through CloudShell: aws sts get-caller-identity, the Arn field. The two must match.
3. Billing and Cost Management → Bills: current month's spend broken down by service and, on the relevant tab, by region.
4. Search box → Trusted Advisor. On the Basic plan you will see a subset (basic security and service limits); the dashboard indicates how many checks are green, amber and red.
5. Resource Groups & Tag Editor → Tag Editor, with All regions, All supported resource types and no tag filter (or an empty key). The result lists the resources with their region.

Solution 2

1. Scheme per item:

2. Three useful groups:

3. A start-up and shutdown scheduling tag, for example Horario, with values such as 24x7 (always on), laborable-8-20 (on from Monday to Friday between 8 and 20) and bajo-demanda (normally off). An automated process then reads that tag and acts accordingly; the automation of that shutdown is built with the services covered in modules 5 and 7, so it is worth defining the tag now.

Solution 3

1. Steps, in order:

   • Billing and Cost Management → Bills, expand the EC2 charge and look at the breakdown by region: that identifies which region it is happening in.
   • Also look at the usage type within the charge: it distinguishes whether it is compute time (BoxUsage), disk storage (EBS:VolumeUsage), snapshots (EBS:SnapshotUsage) or IP addresses (ElasticIP:IdleAddress).
   • Switch the console to that region and review EC2 → Instances, Volumes, Snapshots and Elastic IPs.
   • Use Tag Editor with All regions to see everything that exists in the account.
   • Consult CloudTrail (lesson 05-03) to find out who created the resource and when.

2. Possible causes:

   • An instance in another region (the classic region selector case).
   • An orphan EBS volume, which keeps billing even though the instance has been terminated.
   • An unassociated Elastic IP: AWS charges for addresses you reserve and do not use.
   • Old snapshots of volumes that have already been deleted.
   • A stopped instance (it does not bill compute, but its EBS disk does).

3. Preventive measures:

   • The budget with an alert on the forecasted amount from lesson 01-02: it would have warned within days of the charge starting, not at the end of the month.
   • The mandatory tagging from creation and the resource groups from this lesson: with Proyecto and Propietario on everything, the phantom resource is identified and attributed in seconds, and the per-tag cost breakdown would have made it obvious.
   • As reinforcement, the habit of checking the region before creating and of reviewing the bill's per-region breakdown once a month.

You now know how to move around the AWS console with professional judgement. You have learned to sign in as an IAM user rather than as root, to read the top bar, and —most importantly— to avoid the region selector trap, which is the cause of most phantom resources and inexplicable bills. You have configured Console Home and your favourites to work fast, you have adopted a tagging scheme that in a few months will let you know how much each part of MercadoFresco costs, and you know Tag Editor and Resource Groups for finding and grouping resources scattered across any region. You have also discovered CloudShell, the fastest way to run a command without installing anything, and you know where billing, Cost Explorer and Trusted Advisor live for when we reach modules 5 and 11.

And you have completed your first full resource lifecycle: create, tag, locate and delete. That last step is the habit that will spare you surprises on the bill throughout the whole course.

The console is excellent for exploring and diagnosing, but it has a structural limit: it is not reproducible. Nobody can review in Git what you did with the mouse, nor repeat it identically in a second environment, nor run it a hundred times.

In the next lesson, 01-05 "AWS CLI and SDKs", we make that leap: you will install and configure the AWS CLI v2, learn to use profiles and to filter results with --query, understand credential precedence, and write your first scripts —in bash and in Python with boto3— to manage MercadoFresco's resources repeatably.