Running Dev, Staging and Production inside a single AWS account works right up until it doesn't. A misconfigured security group, a Terraform apply pointed at the wrong workspace, an IAM policy that turned out to be broader than intended — in one account, each of those is a production incident waiting for its moment.

Setting up AWS Organizations from scratch, as the only Cloud/DevOps engineer on the team, forced me to make decisions I would otherwise have deferred: where the account boundary should fall, who gets access to which account and under what conditions, how MFA is enforced rather than merely recommended, and how to write IAM policies that stay least-privilege after the third urgent request to "just make it work".

This article is a practical account of that setup — what I got right, what I would organize differently, and the parts that only become obvious once real workloads are running.