24SCPs sit above every account in the organisation. What are they actually for, and where do teams get burned?▼mediumNewAmazon & AWSTCSInfosys◆ premiumService control policies cap what anyone in a member account can do, no matter what their IAM admins wrote. The craft is choosing a handful of denials that age well.Open full answer →
34Every team wants its own AWS account on day one. How do you hand out accounts safely without becoming a bottleneck?▼mediumNewAmazon & AWSAtlassianGoldman Sachs◆ premiumAccount-per-team is the right instinct, but hand-rolled account setup drifts within a month. Vending turns governance into a pipeline with an SLA instead of a ticket queue.Open full answer →
