The single account that becomes a liability
Every cloud journey starts in one account. Dev, staging, and prod all share it. Everyone has broad access because it's easier. The bill is one big undifferentiated number. It works, right up until it doesn't. A test script in "dev" deletes a production bucket. A leaked key has the keys to the entire kingdom. Finance asks what the data team spent and nobody can answer. One account means one blast radius, and that radius is everything.
This is why mature organizations deliberately run many accounts, sometimes hundreds, and tie them together under a single organization with central governance. It feels like more complexity, and it is, but it buys you isolation, clean billing, and enforceable guardrails that a single account fundamentally cannot provide. This article explains the why and the how: org structure, OUs, SCPs, centralized logging and identity, and the thing that ties it together, a landing zone.
Note: Who this is for: Engineers and platform/architecture folks moving beyond a single account toward real organizational structure. We use AWS Organizations terms (accounts, OUs, SCPs); Azure (management groups + subscriptions) and GCP (folders + projects) have direct equivalents.
