New AWS customers can now sign up with a Google, GitHub, or Apple login, start with $100 in Free Tier credits, and build inside a “project” where AWS and coding agents set up permissions automatically. Paid projects get a monthly spend limit, starting at $20, and a project that reaches its limit is halted instead of running up more charges. Owners who later need multiple Regions or central governance can turn on the full AWS feature set without migrating. The rollout is gradual and covers new customers only.
What new accounts get
New AWS customers don’t have to configure an environment before they build anything. Sign-up works with an existing Google, GitHub, or Apple identity, and most new customers don’t need to enter a credit card. Each account arrives as a project: one AWS account plus settings for sharing it. AWS builds that structure at sign-up and adds security controls it does not list.
Micah Walter, a senior solutions architect at AWS, tried the flow by signing in with his Google account, and his project was ready within seconds. The first screen gave him a block of text for his coding agent. Walter pasted it in. Within moments the agent had him logged in, with the AWS Command Line Interface and the Agent Toolkit for AWS installed and a CLAUDE.md file of setup guidance in his project.
He then asked the agent for an API that returns a new sequential ID on every request. The agent laid out architecture options, then created an AWS Lambda function, an Amazon DynamoDB table, and an Amazon API Gateway endpoint and deployed them. A few minutes later he had a public URL handing out IDs, and he never wrote a permission rule. In this setup, defaults now make two decisions that used to belong to the account owner: who and what can reach each resource, and when spending ends. Anyone whose users expect an app to stay up needs to know where those defaults stop.
The cap stops the project
Every new account starts with $100 in Free Tier credits. Walter’s project picked up another $20 in credits when his Lambda function deployed. Nothing in the launch material says whether every new account earns that bonus the same way.
Moving to a paid plan means adding a payment method and setting a monthly spend limit for each project, starting at $20 a month. The limit works as a ceiling, not a fee. A project with a $50 limit that uses $32 of services in a month costs $32 plus taxes. AWS proposes a limit based on past usage, and the owner can accept it or enter a higher number ahead of planned growth.
Notifications arrive as a project nears its limit. Once spending hits it, “AWS pauses your project rather than accumulating charges,” and work resumes after the owner raises the cap. Budgets are set project by project, which lets an owner keep a throwaway idea at the $20 floor and give more headroom to one that is drawing users.
What a halted project does to a live public endpoint is not spelled out. If your project serves real users, find out before you treat the cap as a safety net. The traffic that makes an app worth keeping online is the same traffic that spends the budget.
The agent writes the access rules
Teammates join through an email invite. No one creates IAM users, the named identities that AWS Identity and Access Management normally uses to decide who can do what, and each invitee sees only the projects the owner names. Adding another project takes a click.
Resource permissions work the same way. Console workflows and coding agents set up access between supported services automatically, which is how Walter’s three services ended up connected without him touching a policy. Which services count as supported is not listed. The practical upshot is that the agent that deployed your code also set what that code can reach, and whoever reviews the account later should check those grants rather than assume a person chose them.
Outgrowing the defaults
Some projects need more than one AWS Region, or custom policies in AWS Organizations, the service that manages many accounts under central rules. Those projects can switch on advanced features at no added cost. The account lands in a configured AWS Organization without moving workloads or taking them offline.
Everything set up before the switch is kept, and nothing in the launch material carves out the access rules an agent wrote in the first week. Those rules become the starting point for whoever administers the account next.
Download eBook: Identity-First Threat Intelligence
