Internally at Amazon people are expected to spin up entire separate AWS “conduit” accounts for different environments. So this only applies if you’re running everything out of one account, which is bad form.