The account structure you set up in your first week on AWS follows you for years. What a sound foundation includes, and the order to set it up.
Most startups launch with a single AWS account. It's the path of least resistance: quick, cheap, and simple to reason about. Three years later, that single account is a compliance liability, a cost management nightmare, and a blast-radius problem waiting to happen.
Getting the account structure right early is one of the highest-leverage architecture decisions you can make. It costs little when you have no infrastructure; it costs enormously to fix when you do.
A Landing Zone is a multi-account AWS environment with a defined structure, security baseline, and governance policies applied consistently. At minimum: a management account for billing and organization-level policies, a security/logging account for centralized audit logs, and separate accounts for each environment (dev, staging, production).
Blast radius: a misconfigured IAM policy in dev can't touch production resources if they're in separate accounts
Cost clarity: account-level billing gives you clean cost attribution without fighting with tags
Compliance: auditors love account separation — it's the simplest way to demonstrate environment isolation
Security: you can apply different security controls and access policies per environment
Team autonomy: developers can have broad permissions in dev without broad permissions in prod
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Moving resources between AWS accounts is painful. Migrating an RDS database, a set of Lambda functions, and their associated IAM roles from a shared account to a production-only account requires careful orchestration, downtime planning, and DNS changes. Doing this to live production traffic is high-risk.
IAM policies grow organically and become unmaintainable. Permission boundaries, role hierarchies, and cross-account access patterns need to be designed — not accumulated. A 3-year-old IAM environment with dozens of ad-hoc policies is a security and audit nightmare.
CloudTrail logs that live in the same account they're auditing can be deleted by a compromised account. Moving logs to a separate, locked-down account after the fact is possible but requires care — and you've already lost the early audit trail.
AWS Organizations with management account dedicated to billing/governance only (no workloads)
Security/Logging account: CloudTrail aggregation, Security Hub, GuardDuty master
Production account: production workloads only, tightest access controls
Dev/staging account(s): developer access, less restrictive but still bounded
SCPs at the OU level: prevent disabling CloudTrail, enforce MFA, block dangerous IAM actions
Everything deployed via CDK or Terraform from the start
This setup takes 2–4 days to implement properly from scratch. The same work takes 2–4 weeks to retrofit into a running production environment.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
7 AWS Architecture Mistakes Startups Make That Become Expensive at Scale
These decisions seem fine at 10 users. At 10,000, they're production incidents, security risks, or five-figure monthly bills.
Read
SOC 2 on AWS: What You Actually Need to Pass the Audit
The AWS controls that actually matter for SOC 2 Type II, and the ones that are pure checkbox theater. Based on real audit experience.
Read
As of January 15, 2025. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.