Why the first hour matters
When an account changes hands, the previous holder knows the password. Until that changes, you do not have exclusive control, and every hour the original credentials stay valid is an hour of unnecessary exposure. This is not a theoretical concern: the whole point of a handover is that someone else created the account.
The good news is that the work is short and mechanical. The checklist below takes under an hour on any provider and leaves you with an account that is genuinely yours.
1. Change the password before anything else
Do this before you look around the console. Use a password manager to generate something long and random, and store it there rather than anywhere else. Do not reuse a password from another account, and do not pick something you can remember, because you should not need to.
If the provider supports it, invalidate active sessions at the same time. Changing a password does not always terminate sessions that are already signed in.
2. Enable multi-factor authentication
MFA is the control that matters most, because it stops a leaked password from being enough on its own. Use an authenticator app or a hardware key rather than SMS where you have the choice, since SMS can be intercepted through number porting.
Enable it on the root or owner identity first. Then save the recovery codes somewhere separate from the password manager entry, because losing both at once locks you out permanently.
3. Audit what already exists
A pre-existing account is not an empty account. Before you deploy anything, look at what is already there.
- Existing users, IAM identities or service accounts, and whether each one should still exist
- Active access keys and API tokens, which should be revoked and reissued rather than inherited
- SSH keys registered on the account
- Running resources you did not create, which will be billing to you from now on
- Any third-party application or OAuth grant with access to the account
Anything you cannot account for should be removed rather than left in place.
4. Move contact and billing details to you
Update the account email, phone number and billing address to your own. This matters for more than tidiness: password resets, security notifications and billing alerts all go to whatever is on file. If the contact address is not yours, the recovery path for the account is not yours either.
5. Stop using the owner login for daily work
The root or owner identity should be used to set up other identities and then left alone. Create a separate user for yourself with only the permissions you actually need, and a separate identity for each teammate or application.
This is the principle of least privilege, and it does real work. It limits what a compromised credential can reach, and it makes the audit log meaningful, because actions are attributable to a person rather than to a shared login.
6. Set a billing alert immediately
Set a budget threshold on the first day, before anything is running. Cloud bills grow from resources nobody remembers starting, and a budget alert is the difference between noticing in a day and noticing at the end of the month.
Set the first threshold low, at a figure that would surprise you. You can always raise it.
7. Turn on activity logging
Every major provider has an audit log: CloudTrail on AWS, Cloud Audit Logs on Google Cloud, the Activity Log on Azure. Turn it on and make sure it is being retained somewhere the account itself cannot trivially erase.
You are unlikely to read it day to day. You will care about it enormously the one time something unexpected happens.
8. Put credential rotation on a schedule
Access keys accumulate. Set a recurring reminder to review and rotate them, and delete any that have not been used recently. Most providers report last-used timestamps for exactly this purpose.
Related cloud accounts
This guide applies across providers. The cloud account catalogue lists every platform with its configurations and prices, and the comparison table puts them side by side.
Further reading
- Linode Accounts: What You Get and How to Choose a Configuration
- AWS vs Google Cloud: Which Cloud Account Should You Buy?
- Azure Accounts: What You Get and How to Choose a Configuration
- Alibaba Cloud Accounts: What You Get and How to Choose a Configuration
Frequently asked questions
Enabling multi-factor authentication. Changing the password matters, but MFA is what keeps the account safe if a password is ever exposed later.
Yes, once you have confirmed you can sign in yourself and have working recovery codes. Verify your own access first so you do not lock yourself out.
Under an hour on any provider. Auditing existing resources is usually the longest part, and it is worth doing properly.
