---
title: "Start every account from one baseline · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/environments/account-baseline
updated: 2026-10-20
licence: "All rights reserved"
---

# Start every account from one baseline

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Environments](https://agentwranglers.se/playbook/infrastructure/environments)
- Rule: Create every new account from code with the same baseline. That means an audit log, a budget, blocked public storage, default encryption and the allowed regions.
- How: Keep the baseline as one module that runs when an account is created. AWS Control Tower, a landing zone or your own account factory can run it. Send the audit log to a separate log account that the other accounts cannot delete from. Add the [budget](https://agentwranglers.se/playbook/infrastructure/cost-and-ownership/budgets-for-every-account) and the [guardrails](https://agentwranglers.se/playbook/infrastructure/policy-as-code/cloud-guardrails) from the same module.
- Check: For every account in the organization, a script confirms the audit trail is on, a budget exists and account-level public access is blocked. It also confirms default disk encryption is on and a call in a region outside the list ends in AccessDenied.

Example:

```hcl
resource "aws_s3_account_public_access_block" "baseline" {
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_ebs_encryption_by_default" "baseline" {
  enabled = true
}

resource "aws_cloudtrail" "baseline" {
  name                       = "account-audit"
  s3_bucket_name             = "example-shop-audit-logs"
  is_multi_region_trail      = true
  enable_log_file_validation = true
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/environments/account-baseline`.

- Previous: [Delete preview environments on time](https://agentwranglers.se/playbook/infrastructure/environments/preview-environments)
- Next: [Turn on threat detection in every account](https://agentwranglers.se/playbook/infrastructure/environments/threat-detection)
- [Environments](https://agentwranglers.se/playbook/infrastructure/environments)