A cloud account is three boundaries at once: a billing boundary, an identity boundary and a blast-radius boundary. Tagging and policies can approximate the first two within a single account. Nothing approximates the third as reliably as simply using a separate account.
What a separate account gives you
-
Unambiguous cost attribution
The invoice is the report. No tagging discipline required, no untagged residue to chase at the end of the quarter.
-
A hard permission edge
A mistake in one account cannot reach resources in another. Policy errors stay contained in a way that is difficult to achieve with in-account controls alone.
-
Clean teardown
When the project ends, everything associated with it goes away together, with nothing left running in a corner.
Where the pattern pays off
- Agencies running work for multiple clients, where isolation is part of the service.
- Separating production from development and staging.
- Short-lived experiments and proofs of concept.
- Migration pilots that must not touch the existing estate.
- Training environments where people are expected to break things.
- Temporary capacity for a launch or a seasonal peak.
The costs, stated plainly
| Cost | Mitigation |
|---|---|
| More places to configure identity | Federate from one identity provider. |
| More places to check for spend | Consolidate billing where the provider supports it. |
| More accounts to secure | Automate the baseline so every new account starts correct. |
| Cross-account access is extra work | Deliberate: that is the isolation you wanted. |
| Volume discounts may fragment | Use the provider’s organisation features. |
The mitigations are real work, but they are one-time work that scales, whereas the confusion of a single shared account grows with every project.
A baseline worth automating
If new accounts are going to be routine, make the setup routine too. Script or template the things every account needs so the tenth one is as well configured as the first.
- Administrative identity created and root locked away.
- Multi-factor authentication required for human logins.
- Audit logging enabled and shipped somewhere central.
- Billing alert configured at a sensible threshold.
- Default tags or labels applied.
- Baseline network configuration created or the default one removed.
Summary
Use separate accounts where the boundary matters: per client, per environment, per experiment. Automate the baseline so creating one is trivial, and keep identity federated so people do not collect passwords. The isolation you get is the kind that holds up when something goes wrong.
