Skip to main content

​
Context

Stackra’s cloud footprint needs account boundaries, one primary region, a tenant region column from the first migration, and budgets that stop spend before it surprises the owner. The owner’s answers DP11, SC9, DC7 and DP20 (mem L433, L449, L552, 2026-10-20) fix these.

​
Decision

  1. Accounts (DP11). One AWS account per product, plus one shared and tooling account. Environments are separated by IAM roles, tags and service control policies. Access is through Identity Center SSO. There are no IAM users.
  2. Primary region (DP11). me-central-1.
  3. Tenant region (SC9). Every tenant row has a region column from the first migration. A tenant’s data stays in its region (ADR 0134 classification applies).
  4. Dev boxes (DC7). Development machines run in the tooling account.
  5. Budgets (DP20). AWS Budgets per account at 50, 80 and 100%. Budget Actions stop non-production accounts. Preview environments have a TTL. Every resource carries cost tags. The Bedrock budget is kept.

​
Consequences

  • A product’s blast radius is one account, and a leaked credential is scoped by the account boundary.
  • Region is a data property from day one, so a second region is a deployment change, not a schema change.

​
Enforcement

planned — the budgets and tags are created by the @stackra/infra-aws package (ADR 0171); the region column is checked by the migration lint (ADR 0159).

​
Alternatives

  • One account for everything: rejected by DP11.
  • IAM users for people: rejected; Identity Center only.

​
Supersedes and sources

Supersedes: none. Sources: owner answers DP11, SC9, DC7, DP20 (stackra-decisions-2026-10-19.md L433, L449, L552, 2026-10-20). Region verification (“verify”: Bedrock in me-central-1) stays open in gap analysis P1-4.