This is excellent, I'm going to use this to separate production from test environments using separate accounts. Using VPCs, security groups, IAMs, tags, etc. i

This is excellent, I'm going to use this to separate production from test environments using separate accounts. Using VPCs, security groups, IAMs, tags, etc. is great, but those are all constructs you have to take care to implement correctly yourself within your deploy scripts. One slip-up and you could accidentally expose environments to each other, or worse make a mistake that deletes or reconfigures resources in an environment you didn't intend to. Or an errant process in a test environment could unexpectedly gobble up too many resources, resulting in production being throttled. So separate accounts is the safest isolation approach, but historically there have been drawbacks (this blog post discusses some[1]), like billing is more expensive (due how AWS charges for usage and you won't be sharing reserved instances anymore) and I wasn't sure how to handle things that need to be cross-environment, like Route53 (DNS). Looking forward to trying this out! [1]: https://charity.wtf/2016/03/23/aws-networking-environments-and-you/ https://charity.wtf/2016/03/23/aws-networking-environments-a...