Account creation, regions, free tier, IAM admin user setup, root-only tasks, and a tour of the services you will actually use — configured correctly from the start.

Give browsers direct access to a private S3 bucket using time-limited signed URLs — no credentials, no proxy, no server bandwidth consumed by file data.