Regions, Availability Zones and how AWS bills you

Sign in first and set the profile for this window, so you don’t have to type it on every command:

aws login --profile saat-root
$env:AWS_PROFILE = 'saat-root'
cd C:\aws-lab

1See which Regions are on

Run this:

aws ec2 describe-regions --all-regions --query "Regions[?starts_with(RegionName,'ap-south')].[RegionName,OptInStatus]" --output text

You should see this (unless you enabled Hyderabad):

ap-south-1      opt-in-not-required
ap-south-2      not-opted-in

Mumbai is on by default. Hyderabad is an opt-in Region and stays off. Leave it off; you don’t need it for this course.

2Compare zone names and zone IDs

Run this:

aws ec2 describe-availability-zones --query 'AvailabilityZones[].[ZoneName,ZoneId,State]' --output text

You should see something like this (your name-to-ID pairs may differ):

ap-south-1a     aps1-az1        available
ap-south-1b     aps1-az3        available
ap-south-1c     aps1-az2        available

3Create two tagged resources that cost nothing

A security group and a standard Systems Manager parameter don’t cost anything, so they are good for practising tags.

Paste this whole block:

$sg = aws ec2 create-security-group --group-name lab04-tag-test --description "Lesson 4 tag test" --tag-specifications 'ResourceType=security-group,Tags=[{Key=course,Value=saatvedha-aws},{Key=lesson,Value=04}]' --query GroupId --output text
$sg
aws ssm put-parameter --name /lab/04/note --type String --value "tag test" --tags Key=course,Value=saatvedha-aws Key=lesson,Value=04

You should see something like this:

sg-0a1b2c3d4e5f67890
{
    "Version": 1,
    "Tier": "Standard"
}

4Write the lab finder script

Run this to create C:\aws-lab\Find-LabResources.ps1:

@'
param([string]$Tag = 'saatvedha-aws')
$regions = aws ec2 describe-regions --query 'Regions[].RegionName' --output text
foreach ($r in ($regions -split '\s+')) {
    $arns = aws resourcegroupstaggingapi get-resources --region $r --tag-filters "Key=course,Values=$Tag" --query 'ResourceTagMappingList[].ResourceARN' --output text
    foreach ($a in ($arns -split '\s+')) {
        if ($a -and $a -ne 'None') { [pscustomobject]@{ Region = $r; Resource = $a } }
    }
}
'@ | Set-Content C:\aws-lab\Find-LabResources.ps1
.\Find-LabResources.ps1

After a minute or so, you should see something like this:

Region     Resource
------     --------
ap-south-1 arn:aws:ec2:ap-south-1:123456789012:security-group/sg-0a1b2c3d4e5f67890
ap-south-1 arn:aws:ssm:ap-south-1:123456789012:parameter/lab/04/note

The script asks every Region that is turned on, so it also catches resources created in the wrong Region by mistake. If PowerShell refuses to run the script, run Set-ExecutionPolicy -Scope CurrentUser RemoteSigned once.

5Activate the cost allocation tags

In the console, open Billing and Cost Management, then Cost allocation tags. Find course and lesson under user-defined tags and choose Activate. New tag keys can take up to 24 hours to appear in this list, so come back tomorrow if they aren’t there yet.

Open Cost Explorer once too; AWS turns it on the first time you open it.

6Look at this month’s cost from the CLI

Run this (each Cost Explorer API call costs USD 0.01, so don’t put it in a loop):

$start = (Get-Date -Day 1).ToString('yyyy-MM-dd')
$end = (Get-Date).AddDays(1).ToString('yyyy-MM-dd')
aws ce get-cost-and-usage --region us-east-1 --time-period "Start=$start,End=$end" --granularity MONTHLY --metrics UnblendedCost --query 'ResultsByTime[0].Total.UnblendedCost'

You should see something like this:

{
    "Amount": "0",
    "Unit": "USD"
}

7Clean up

Run this:

aws ec2 delete-security-group --group-id $sg
aws ssm delete-parameter --name /lab/04/note
.\Find-LabResources.ps1

The finder may still list the deleted items for a few minutes while the tagging index catches up. Run it again until it prints nothing.

✅ Checkpoint: Find-LabResources.ps1 exists in C:\aws-lab, it listed your two tagged resources, and after cleanup it prints nothing.