Yup. The scope of the discussion was around permissioning/security, so I didn't get into billing, but you're absolutely right. You should have CloudTrail, bill

Yup. The scope of the discussion was around permissioning/security, so I didn't get into billing, but you're absolutely right. You should have CloudTrail, billing alarms, and dashboards all setup. It may also be a good idea to setup automatic spring cleaning that nukes resources every two weeks or so unless they have special tags to mark retention.