AWS lets coding agents write the first access rules in a new account

The flow starts with a block of text on the first screen, meant to be pasted into a coding agent ^[6]. Micah Walter, a senior solutions architect at AWS, signed in with his Google account and had a project within seconds ^[7]. He pasted the text. Within moments the agent had him logged in, with the AWS Command Line Interface and the Agent Toolkit for AWS installed and a CLAUDE.md file of setup guidance in the project ^[8].

Walter then asked for an API that returns a new sequential ID on every request. The agent laid out architecture options, created a Lambda function, a DynamoDB table and an API Gateway endpoint, and deployed them ^[9]. A few minutes later a public URL was handing out IDs, and he had not written a permission rule ^[10]. The access between those services came from the console workflow and the agent ^[11]. AWS has not said which services get that automatic wiring ^[11], or what security controls the sign-up adds ^[3].

Every new account starts with $100 in Free Tier credits ^[4], and Walter's project picked up $20 more when his Lambda deployed ^[12], so he had $120 to spend before a payment method mattered ^[1]. Paid plans require a payment method and a monthly limit for each project, starting at $20 ^[13]. The limit is a ceiling: a project with a $50 limit that uses $32 of services pays $32 plus taxes ^[14]. AWS proposes a number based on past usage, and the owner can enter a higher one ^[15].

Notifications arrive as a project nears its limit ^[16]. At the limit, AWS's material says, "AWS pauses your project rather than accumulating charges," and work resumes after the owner raises the cap ^[17]. AWS does not say what that pause does to a live public endpoint ^[18]. Budgets are per project, and a throwaway idea can sit at the $20 floor ^[20], so a public URL on a floor-level ceiling can be taken offline by billable traffic alone ^[2].

Teammates arrive by email invite. That invite skips IAM users, the named identities AWS Identity and Access Management normally uses to decide who can do what, and each invitee sees only the projects the owner names ^[19]. Access to the project rests on the Google, GitHub or Apple account used at sign-up ^[3].

The rollout is gradual and covers new customers only ^[5], so accounts a cloud team already governs keep the baseline they have. AWS describes the upgrade as landing the project in a configured AWS Organization at no added cost, without moving workloads or taking them offline ^[21]; that description stops short of a path into an Organization the customer already runs ^[23].

Everything configured before that switch is kept, and the launch material exempts none of the access rules an agent wrote in the first week. Those rules are the starting point for whoever administers the account next ^[22].