The smallest setup that still counts
- One management account, plus separate accounts for shared services, logs, and each workload family.
- Identity federation to your existing directory — no long-lived IAM users, ever.
- A hub network with inspected egress, so nothing reaches the internet by accident.
- Preventive guardrails (region locks, encryption requirements) before detective ones.
The mistake I see most
Teams build one giant account "to keep it simple" and pay for it for years in blast radius and billing fog. Splitting accounts early is nearly free; splitting them late is a migration project of its own.
Takeaway: three accounts, federated identity, and inspected egress beat any amount of tooling added later.
