How we locked down our AWS organization

A single AWS account is fine until it isn't 😅 The moment you have more than one workload, the math mostly flips! You want separation, isolation, per-project billing, and the same set of guardrails everywhere!

We rebuilt our AWS Organization from the ground up in Terraform. Three OUs, six member accounts, no IAM users anywhere, Identity Center for humans and GitHub OIDC for CI. The post walks through the four layers that turn a bare org into something we trust ourselves with:

• SCPs - block expensive instance families, pin everyone to four regions, deny Bedrock org-wide, kill CloudTrail tampering, and enforce MFA on every IAM user.
• RCPs - enforce TLS on S3, SQS, and Secrets Manager, and slam shut S3 public access — even for callers outside the org.
• CloudTrail → EventBridge → Lambda - an org-wide trail and a small Node.js Lambda that fans events out to SES and Slack, color-coded by severity.
• The kill switch - a $50 monthly budget on the Sandbox OU paired with a Budget Action that automatically attaches a deny SCP at 80% actual spend.

The post is honest about the sharp edges too: SCPs do not restrict the root user of the management account and AWS Budgets data lags 8 to 12 hours so no native AWS feature truly enforces a real-time spending cap.