[forgomonika]

> I strongly prefer to get rbac/iam properly implemented in a single account wherever possible.

This can really help manage complexity but it the more this account grows the riskier it becomes if a bad actor breaks into the account (ranging from fraudsters/hackers to disgruntled employees).

[mattpallissard]

Using accounts as the security boundary is easier to reason about up front but it's rather ham fisted. If you're centrally automating large swaths of infrastructure across many accounts you'll wind up paying for that in the long run.

When a shop smaller, or dealing with multi-tenancy situations, multiple accounts is an easy trade off to make. The account boundary has its place, but it's not for everything.

Some of these scaling pains with hard boundaries have gotten better with awssso and iam features over the years but you still run into them on occasion.

As far as whatever you mean by "breaking into an account". I said originally, "rbac/iam properly implemented". If you fuck that up, it doesn't matter whether or not you have one or multiple accounts.

Having a single account does mean that you have to give anyone the keys to the kingdom or that you don't separate your concerns.