Environments Required

Give each environment its own account

Run production in its own cloud account, project or subscription. Development, staging and previews each live in another one.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

An account is the strongest wall a cloud offers. Keys, limits, bills and mistakes stay inside it. Group the accounts under one organization, such as AWS Organizations, a Google Cloud organization or Azure management groups. Give staging and CI for staging no role they can take in production. Connect production networks to others only where one named service needs it. On a small host without accounts, use a separate project and API token per environment.

Example

# Run with the staging deploy role. Expect AccessDenied.
aws sts assume-role --role-arn arn:aws:iam::111122223333:role/deploy-production --role-session-name check

How to check

The production account holds no resource tagged with another environment. The staging deploy role tries to assume the production deploy role and gets AccessDenied.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/environments/account-per-environment.