Unfortunately the word free is a little ambiguous since it can be free (as in beer) but suddenly you are charged because you make something stupid (or someone hacked your account and created a zillion services)
Which is why you enable Multi Factor Authentication beforehand and make sure the roles you assign the instances you create don't have write access except for the one bastion, which you make sure doesn't have root login or even access to the public internet except for your IP but still have access to your private servers via VPCs.