So far we haven’t had any issues or bad surprises, although we have setup some aws billing alerts just in case.
Feel free to make them responsible for cost and resources and you’ll be surprised how well they can manage their own account.
How many developers work at your organization?
My experience with these has been decidedly mixed. As in, you define them and never, ever see an alert.
We always get the alerts in time with thresholds set to 70% of the wished value.
Wow, this is horrible. I understand responsability but this is too much. Are other employees responsible if the company loses money for their actions?
Lessons learned for everybody, it’s a win-win situation.
I’ve had to do it a couple of times for personal and profesional accounts, and I’ve never had any rejections from them
Giving people responsibility and autonomy also comes with some responsibilities by the providers in a shared responsibility model is all I’m saying and every policy works out fine until it doesn’t.
Other accounts and environments (including dev) require everyone to follow a streamlined process: read only access to the account, a fully documented solution design and a corresponding terraform project in GitHub. terraform project checkin triggers a pull request for a review and an approval. Once the pull request has been scrutinised and merged, CI/CD runs terraform to provision resources in the account.