Comment by craigmcnamara

Root account for billing and AWS Identity Center. Dev account for all the crap and lax permissions so people can try stuff. Production account with only production and extremely strict permissions where changes can only be made with terraform or a god mode account.