A single AWS account feels simpler right up until the day a misconfigured policy in dev can reach production data. Multiple accounts are not bureaucracy; they are blast-radius control you get almost for free.
This is a working note rather than a definitive guide — the patterns here come from systems I’ve actually shipped and the trade-offs I kept running into along the way.
Let the org chart draw the account boundaries
I map accounts to the things that genuinely need isolation — environments, sensitive workloads, and teams that should never step on each other. Guardrails live at the organization level so the rules are the same everywhere and nobody has to remember them.
The best security control is the one a tired engineer cannot accidentally bypass.
A small, well-tended landing zone — centralized logging, a sane network baseline, and automated account vending — turns “spin up a new environment” from a week of tickets into an afternoon.
None of this is glamorous, but it’s the part that decides whether a design holds up once real traffic and real deadlines arrive.