Dead Letter Queue
Part 1: The unclaimed
It began with a single instance. Easy to spin up. Easy to tame. We called it simple but infrastructure, like ivy, has a habit of climbing. Before the leaves could even form, the project had swallowed its own shadow. Dev. Test. Staging. Prod. Each a fractured realm, echoing with overlapping ghosts.
They were not deployed by policy. They were born of desperation and hope; of 16:55 deployments for that one ground-breaking feature that never completed, forgotten at 17:00 and left to fester like abandoned campsites. They were the personal S3 buckets and rogue API gateways with someone’s surname on it. The manual Lambda deployments that slipped past CI/CD. The resources that held no name, no namespace, no shepherd. They drifted through the cloud, shapeless and untagged, hoarding logs, consuming credits, hiding in the blind spots of console views.
Only when the wrong instance was deleted and the customer called, or when it was impossible to decide which serverless function was the correct one did we turn to the Oracles of the internet for guidance. Draped in synthetic authority, they chanted the liturgy: “Praise the tags!” “For billing! For permission scoping!” We tried. We really tried. But each service decides their allegiance to tags, and whether or not they shall obey them.
The true horror did not lie in the tagging itself. It lay in permission scoping.
We tried to weave permissions into the very fabric of the cloud, but the fabric was stitched from a thousand different body parts under one head. S3’s condition keys bled into IAM’s policy language. Resource ARNs twisted into API Gateway’s mismatched syntax. It was a Frankenstein’s monster of a cloud — a limb here, a nerve cluster there, held together by desperate glue and outdated best practices. Nothing aligned. Nothing obeyed. We sat back, breath shallow, trying to remember our original covenant: visibility + role separation + independent usage + cost report separation. But how could we bind the storm when the new engineer deployed a serverless function and simply… forgot to tag?
The untagged ones stirred. They pooled. They blurred. Billing reports fractured into Rorschach tests. Permissions granted to tenanted ghosts. Roles drowned in noise. The cloud was no longer a managed platform. It was a labyrinth of half-formed things, scratching at the walls of our own making, feeding on our confusion.
And in the silence, we realized: we were drowning in the unclaimed.
The light in the darkness
But then, a whisper from the archives. A truth so quiet it had been drowned out by the fog of tags: AWS accounts do not cost.
Get Jorge Hermoso’s stories in your inbox
Join Medium for free to get updates from this writer.
Not a cent. Only the resources within them breathe life, and only life demands payment. We had been trying to cage a hurricane with paper talismans, when the architecture itself offered a vault.
The salvation was not in more tags. It was in walls.
One account per environment. Not just the sacred realms of Staging and Production, but the very playground — the developer’s testing ground, the soil where every experimental root took hold. Each a sealed vessel. Each a clean slate. If the billing specters rose beyond the approved threshold, we could do what we had feared to do: we could walk in, and send the account to oblivion (remember the grave has a waiting period of 90 days). Or, with surgical precision, carve away the rogue resources. No contagion. No bleed.
We mapped the shadows into Organizational Units. One OU per project, or per environment (let‘s debate the geometry of the domains on a different occasion). Beneath each OU, the accounts stood like sentinels. SCP policies became our iron wards, severing access to the expensive, the dangerous, the unproven. IAM Identity Center was forged to walk across accounts, carrying identity but never crossing the boundaries. The shared RDS instance? A dedicated shared resources account, a vault built for all. The contractor’s temporary frontend? A fresh account, born with them, vanished when they departed.
One account. One purpose. One account per goal.
I could list the virtues of this approach until the sky turns black. Each benefit a chapter unto itself. But those are different stories.
There is a cost, and it is a transparent one. Every account you create brings its own oversight mechanisms. Control Tower deploys its auditing tools — Config, CloudTrail, and event logging — within each one, and each of these mechanisms generates a charge. Your total cost increases with every account you add.
But there is a second cost, one you incur by choice. Do not assign a separate public VPC to every account, complete with an Internet Gateway and NAT Gateways that consume resources hour after hour. Do not assign each one its own RDS instance, running in isolation, hidden away. These are ghosts of your own creation, resources you pay for repeatedly, even though no one needs them. A private VPC in each account connected to a shared-resources account that manages Internet egress or the database, performs the same function at a fraction of the cost.
We stopped trying to label the storm. We built the dam.
The cloud does not fear names. It respects boundaries. Step forward. Claim the ground. Forge the accounts. Wield the policies. Let the untagged ghosts fade into the dark where they belong.
The architecture is no longer a monster. It is a kingdom. And we hold the keys.
