Resource Hierarchy
Where a resource sits decides which policies reach it, who can see it, and whose budget it lands in. Moving it later moves all three.
-
-
Before the First Workload: Accounts, Guardrails, and the Landing Zone
Retrofitting an account structure means moving every resource. The hour spent on the hierarchy beforehand is the cheapest hour in a cloud programme.
-
Service Control Policy
Effective permission is the intersection of the guardrail and the identity policy. A policy allowing everything still gives a user with no permissions nothing.
-
Landing Zone
If a team cannot ask for an environment and receive one, what you have is a standards document rather than a landing zone.