aws-exploration-credits

name	aws-exploration-credits
description	Claim AWS's new-account "exploration activities" credits (up to $100 — $20 each for EC2, Lambda, Budgets, RDS, Bedrock) at near-zero real cost via the AWS CLI, then verify and tear down. Use when the user asks to claim AWS activity credits, earn AWS free credits, complete AWS exploration activities, or check their AWS credit balance.

AWS Exploration-Activity Credit Claim

AWS accounts created after 2025-07-15 can earn $20 per activity (up to $100) by using five services once. Four of the five are automatable from the CLI; the whole run costs < $0.05 because billable resources live for minutes and are then destroyed.

Preconditions — check these first

1. Recent AWS CLI (the freetier activities API needs a mid-2025+ build): aws freetier help must work. If not: brew install awscli.
2. Working credentials with admin-ish permissions: aws sts get-caller-identity. Needs: budgets, iam (role create), lambda, ec2, rds, ssm get-parameter, bedrock-runtime invoke, freetier read.
3. Eligibility: aws freetier list-account-activities returns the five activities. Older accounts get an empty/unsupported response — stop and tell the user their account predates the program. Also check expiry: activities expire ~6 months after account creation (expiresAt on get-account-activity).
4. A region for the throwaway resources — default to the profile's configured region.

Run

scripts/claim.sh status                                   # plan state, remaining credits, activity statuses
scripts/claim.sh run --region us-east-2 --email [e-mail] # do everything + teardown billable
scripts/claim.sh cleanup                                  # remove ALL created resources incl. $0 ones

run performs, in order (all idempotent, all named credit-activity-*):

Activity	What the script does	Real cost
Cost budget (Budgets)	$10/month cost budget, optional 80% email alert	$0 (first two budgets free)
Web app (Lambda)	python3.12 arm64 function + function URL (the activity requires the URL), invoked once	$0 (free tier)
RDS database	db.t4g.micro Postgres, 20GB gp3, no backups, not public — deleted after reaching available	~$0.005
EC2 instance	t4g.micro AL2023 (SSM latest AMI), terminated after running	~$0.002
Bedrock model	converse on Amazon Nova Micro via geo inference profile — may not count, see below	< $0.001

The Bedrock caveat (manual step)

The activity requires "submit a prompt in the Amazon Bedrock playground" — a console surface. Observed 2026-07: a successful bedrock-runtime converse API call does NOT complete the activity (status stayed NOT_STARTED while the other activities completed). Tell the user to do the 10-second console version: Bedrock → Playgrounds → Chat → select Amazon Nova Micro → send one prompt. No model-access approval is needed for Amazon Nova models.

Verify

• scripts/claim.sh status — activity statuses flip NOT_STARTED → COMPLETED asynchronously; credits post to aws freetier get-account-plan-state (accountPlanRemainingCredits).
• Observed timings (2026-07): Budgets, RDS, and Lambda flipped COMPLETED and their $60 posted within ~15 minutes of resource creation; EC2 sat in IN_PROGRESS briefly before completing. Allow up to a few days before investigating.
• Grant-level detail (expiry dates, per-credit breakdown) is console-only: Billing and Cost Management → Credits.
• Don't re-run resources to "force" completion — the events are already recorded; patience beats respend.

Failure modes

• freetier unknown service → CLI too old, upgrade first.
• Function URL returns 403 with correct AuthType NONE + public policy → observed on a brand-new account: the URL kept returning {"Message":"Forbidden"} 15+ minutes after creation even though get-function-url-config showed AuthType: NONE, get-policy showed lambda:InvokeFunctionUrl for Principal: *, and direct lambda invoke returned 200. This did not block the activity — it completed and paid out while the URL was still 403. Suspected new-account guardrail or slow propagation; if you actually need the URL public, retest later instead of changing the (already correct) config.
• No default VPC → script runs aws ec2 create-default-vpc.
• t4g capacity/unsupported in region → script falls back to t3.micro x86.
• Bedrock AccessDeniedException → use the console playground path instead.
• RDS delete blocked → the script waits for available first; a DB can't be deleted mid-creating.

Cleanup / rollback

scripts/claim.sh run already tears down EC2 + RDS. What intentionally remains is $0: the budget (genuinely useful — keep it) and the idle Lambda + its role. scripts/claim.sh cleanup removes everything including those.

Don't

• Don't create multiple AWS accounts to farm these credits — that violates the AWS Free Tier terms and gets accounts suspended.
• Don't use root credentials for this; run it as an IAM user/role.