How to prevent member accounts from leaving your AWS organization

When you start in AWS, you probably start small.

You open an account and start trying out services, building PoCs, and understanding how everything works before committing to designing environments to host your production workloads.

Other teams hear that you have AWS access and start requesting access to the same account to also build PoCs for their specific use cases. But soon the account starts to get messy: resources from different teams are scattered everywhere, and teams see their PoCs impacted by others deleting resources. So, you start looking for a better solution.

You then create a second standalone account, and then a third, and a fourth. You grant access to each team so that everyone has environments completely isolated from each other.

However, you soon realize that dealing with separate billing, security, and governance across multiple accounts is a pain, so you start looking for a better alternative again.