AWS Reference Platform
Five AWS accounts, each with a single job. Separation is the control: a mistake or a breach in one account cannot reach the others, and the audit record lives somewhere the workloads cannot write to.
Owns the organization. No workloads ever run here.
Access is federated. No passwords, no access keys.
The evidence locker and the detection hub.
Workload accounts can write logs here, never read or delete them.
Common infrastructure every workload borrows.
All internet-bound traffic leaves through here, and only here.
Where applications actually run. Fully disposable.
Destroyed and rebuilt on demand. Nothing of record lives here.
Provisioned and governed, awaiting first production workload.
Separated from dev now, so promotion later needs no re-architecture.
No person holds standing credentials to make changes. Automation authenticates per run and its permissions are capped, so even the deployment pipeline cannot disable logging or create a long-lived key.