Account and region

In 1 minute

An AWS account is the container for all our resources, their permissions and their bill. A region is one geographic area of AWS, with its own copy of each service. MiniTickets uses one account and one region, us-east-1. Every resource gets a name built from the stack, like minitickets-dev-vpc, so two copies of the app never collide.

Picture it

flowchart TB
  ACC["AWS account<br/>IAM, quotas, bill, budget"] --> REG["Region us-east-1"]
  REG --> AZ1["Availability zone 1"]
  REG --> AZ2["Availability zone 2"]
  REG -.-> G["Global: IAM, CloudFront"]

A region holds several availability zones: separate data centres close to each other.

How it works

1. The account is the boundary. IAM users and roles, service quotas and billing all belong to one account. Nothing in another account can touch ours unless a policy says so.
2. The region decides where things live. A VPC, a database or a queue exists in exactly one region. The console and the CLI show one region at a time.
3. Some services are global. IAM and CloudFront are not tied to a region. CloudFront can only use certificates from us-east-1.
4. Names come from the stack. Pulumi calls one environment a stack. The stack dev gives minitickets-dev-* names, /minitickets/dev/* log groups and minitickets/dev/* secrets.

In MiniTickets

The region is aws:region: us-east-1 in the committed infra/Pulumi.dev.yaml. Credentials never live in that file: each terminal runs export AWS_PROFILE=ticketlite first. All names come from infra/src/names.ts → namesFor.

A monthly budget, minitickets-dev-monthly-cost, has a 20 USD limit and emails at 25%, 50% and 100% of real spending, plus when AWS forecasts the month will pass 100% (infra/src/budget.ts → createBudget).

From → to	What happens	What allows it
Monthly cost budget → AWS account and region	watches the whole account's monthly cost	metric COST budget 20 USD per month; emails at 25%, 50%, 100% actual and 100% forecastcreateBudget

See the account on the map →

See it in AWS

Console

Top right: the account menu shows the account id; the region picker must say N. Virginia (us-east-1).

CLI

aws sts get-caller-identity prints the account id and the role you are using.

Code

infra/src/names.ts → namesFor and the region in infra/Pulumi.dev.yaml.

Break it

Symptom	Cause	Where to look
The console shows no minitickets-dev resources	The region picker is on another region	The region picker
The CLI shows another account or AccessDenied	AWS_PROFILE is not set in this terminal	aws sts get-caller-identity
The 50% budget email comes in week one	Everything stayed switched on	infra/Pulumi.dev.yaml switches

Say it in an interview

Say it like this (20-30 seconds)

An AWS account is the security and billing boundary: IAM, quotas and the bill all live there. A region is a geographic area with several availability zones. MiniTickets runs in one account in us-east-1, and every name comes from the Pulumi stack, so a second stack gets minitickets-prod names with no collisions. The trade-off of one account is a weaker blast radius than separate dev and prod accounts.

Follow-ups

Why not separate accounts for dev and prod?

Separate accounts give the strongest isolation: a mistake in dev cannot touch prod, and each has its own quotas and bill. MiniTickets has only dev today. Because every name comes from the stack, a second stack in a second account needs no code change.

What breaks if someone runs a command in the wrong region?

Nothing is found, so it looks as if everything was deleted. A create command would make a resource in the wrong region that nothing uses. Always check the region first.

Why us-east-1?

It has every service, and CloudFront’s certificates must come from us-east-1 anyway. The trade-off is distance: users far from the US east coast get a little more latency.

Advanced: Quotas and the budget

Service quotas are per account and per region, for example how many Lambda functions may run at the same time. A brand-new account can start with lower quotas than the documented defaults; MiniTickets met this with Lambda concurrency (see the casebook). The budget only warns: it never stops anything. Turning resources off is done with the switches in infra/Pulumi.dev.yaml.

Checkpoint

Answer these without scrolling up. If one feels hard, reread that section.

1. What three things belong to an AWS account?
2. Which two services in this chapter are global?
3. Where is the region of MiniTickets written down?
4. How does a second stack avoid name collisions?
5. What does the budget do, and what does it not do?

Redraw it from memory: the account, the region us-east-1 with two availability zones, and the global services beside it

Try this: run aws sts get-caller-identity with and without AWS_PROFILE=ticketlite and compare the Account field

Mark this page as read