Heroku Private Spaces vs AWS: security, networking, and pricing compared

Key takeaways

• Short answer: Heroku Private Spaces win on turnkey single-tenant isolation, managed data services, and zero operational work. Your own AWS account wins on network topology, encryption key custody, audit-log ownership, region and instance choice, and discount eligibility. Heroku bills fixed per-dyno list prices with no discount levers; AWS bills metered resources you can cut with AWS Compute Savings Plans, Reserved Instances, and Spot.
• Heroku Private Spaces are a dedicated single-tenant runtime pinned to one region, with an isolated private network, VPC peering to an AWS VPC you control, Trusted IP Ranges, stable outbound IPs, Private Space DNS, and HIPAA/PCI-eligible Heroku Shield Spaces. The infrastructure sits in Salesforce's AWS account, not yours.
• Heroku runs on AWS. This is not a hardware comparison. It is a question of who holds the cloud account, the VPC and route tables, the AWS KMS keys, the CloudTrail trail, and the invoice.
• Heroku Private Spaces cannot use AWS Compute Savings Plans, Reserved Instances, Spot, Enterprise Discount Programs, or AWS credits, because the cloud invoice is not in your name. That is usually the single largest cost difference at scale, ahead of the raw compute delta.
• There is a third path: keep git-push deploys and per-PR preview environments while workloads run inside your own AWS, GCP, Azure, Scaleway, or existing Kubernetes account. That is the bring-your-own-cloud model Qovery implements, and that Northflank and Porter also offer.

Heroku Private Spaces vs AWS: which one should you choose?

Choose Heroku Private Spaces when the fixed per-dyno bill costs less than a platform engineer and your app fits one region; choose your own AWS account when you need custom VPC topology, AWS PrivateLink or AWS Transit Gateway, customer-managed AWS KMS keys, committed-spend discounts, or regions, instance families, and GPUs Heroku does not offer. On security, both run regulated production workloads, so the real differences are who holds the encryption keys, who owns the raw audit logs, and who signs the HIPAA BAA. On networking, a Private Space gives you a private network with VPC peering and Trusted IP Ranges inside one region, while AWS gives you arbitrary topology. On pricing, a Heroku Private Space starts at $125/month for a single Private-S dyno with no discount levers, while running it yourself starts with the Amazon EKS control plane at $0.10 per cluster-hour, about $73/month, on top of metered compute you can discount.

Here is the same verdict on the three axes the rest of this article measures. Security: the differentiator is encryption key custody, audit-log ownership, and who signs the HIPAA BAA, not the raw count of certifications on either side. Networking: Private Spaces give a private network plus VPC peering and Trusted IP Ranges inside one region; AWS gives you AWS Transit Gateway, AWS PrivateLink, multi-region, and Route 53 private hosted zones. Pricing: fixed per-dyno Private tiers with no discounts versus metered AWS resources eligible for AWS Compute Savings Plans (up to 66% off on-demand), Reserved Instances, and Spot.

There is a third path worth naming up front: bring-your-own-cloud internal developer platforms that keep the git-push workflow while your workloads run in your own account. I cover that in detail near the end, with no pitch here.

Here is the decision in six lines you can lift straight out:

• Pick Heroku Private Spaces if your team has no dedicated infrastructure owner and you value one vendor doing all the platform work.
• Pick Heroku Shield Spaces if you need HIPAA or PCI in a single-tenant runtime and are comfortable with Salesforce holding the keys and signing the BAA.
• Pick your own AWS account if a security review demands customer-managed AWS KMS keys and raw CloudTrail logs inside your own account.
• Pick your own AWS account if you have an AWS committed-spend agreement, Enterprise Discount Program, or startup credits you cannot apply to a Heroku invoice.
• Pick your own AWS account if you need multi-region, AWS Transit Gateway, AWS PrivateLink, GPUs, or instance families Heroku does not offer.
• Pick a BYOC platform if you want the git-push workflow and per-PR preview environments but need all of the above to stay in your own account.

What is a Heroku Private Space, and how is it different from running on AWS yourself?

A Heroku Private Space is a dedicated single-tenant runtime that Heroku operates for you inside one AWS region, with its own isolated private network, Private Dynos, private data services, and Private Space DNS (Heroku Dev Center). Running on AWS yourself means you own the account, the VPC and route tables, the IAM boundary, the AWS KMS keys, the audit trail, and every hour of the operational work.

Heroku itself runs on AWS. Heroku's own security policy states its physical infrastructure "is hosted and managed within Amazon's secure data centers and utilize the Amazon Web Service (AWS) technology" (Heroku security policy), and the newer Fir generation runs on Amazon EKS (Heroku generations). So this is a control-plane and ownership comparison, not a silicon comparison. The chips are the same. What differs is who holds the account around them.

Three runtimes, three deltas:

• Common Runtime: multi-tenant dynos on shared infrastructure, no dedicated network. Fine for most apps, wrong for isolation requirements.
• Private Spaces: a dedicated single-tenant runtime with its own private network, Private Dynos, and VPC peering to an AWS VPC you control.
• Heroku Shield Spaces: Private Spaces plus HIPAA and PCI-eligible controls, an encrypted dyno filesystem, and stricter logging and session behavior (Heroku compliance).

What you give up inside a Private Space: no node-level access, a published list of 10 regions (Heroku regions), no co-locating arbitrary AWS services inside the space, no instance family choice, no GPUs, and no control over subnets or route tables. What you give up on raw AWS: buildpacks and a build pipeline, the dyno process model, release phase, and managed routing, TLS, and log drains, unless you assemble those from AWS CodeBuild, Amazon ECR, an Application Load Balancer, AWS Certificate Manager, and Amazon CloudWatch or their equivalents.

The rest of this article measures three axes, each with its own table or worked numbers: security and compliance, networking, and pricing.

How does Heroku Private Spaces security compare with AWS security?

Heroku Private Spaces give you single-tenant isolation, encrypted data services, Trusted IP Ranges, SSO, and HIPAA/PCI-eligible Shield Spaces with almost no configuration work. AWS gives you the same properties only after you configure them, plus customer-managed AWS KMS keys, IAM and service control policy boundaries, and raw CloudTrail evidence inside your own account, which is exactly what a Private Space structurally cannot hand over.

Start with encryption key custody, because that is the question regulated buyers actually raise in a review. On Heroku, encryption is managed by the platform; you do not get a key you can inspect, rotate on your own schedule, or revoke. On AWS, a customer-managed key in AWS KMS costs $1 per key per month plus $0.03 per 10,000 requests, and the key policy is, in AWS's own words, "exclusively controlled by" you, with automatic annual rotation and grants under your control (AWS KMS developer guide). That single difference decides a lot of security reviews.

Isolation model: a Private Space gives you a dedicated runtime and dedicated private network, versus the multi-tenant Common Runtime. On AWS you pick the boundary yourself, whether that is separate accounts under AWS Organizations, separate VPCs, or separate clusters and namespaces. Identity and access: Heroku offers Teams roles plus Heroku Shield SSO and SAML, while AWS gives you IAM with service control policies, permission boundaries, session policies, and per-environment RBAC mapped to your directory.

On compliance, both sides are strong, and the honest framing is not a certification count. Heroku's platform carries SOC 1/2/3, ISO 27001/27017/27018, and PCI DSS Level 1 for Shield, and Salesforce will sign a Business Associate Addendum for HIPAA workloads through its sales team (Heroku compliance). AWS also signs a standard HIPAA BAA and maintains a regularly updated list of HIPAA-eligible services (HIPAA-eligible services reference), and it publishes its attestations across certifications, laws and privacy regulations, and alignment frameworks that you can pull yourself from AWS Artifact. The difference is not who has more paper. It is that on AWS the evidence sits in your account and you export it on demand; on Heroku, the evidence belongs to Salesforce and you request it.

Audit and logging follow the same pattern. A Private Space gives you a Heroku audit trail and log drains. Your own AWS account gives you AWS CloudTrail, VPC Flow Logs, Amazon GuardDuty, and AWS Security Hub, with retention windows you set, immutability via Amazon S3 Object Lock, and exports you own outright. Shared responsibility splits cleanly too: in a Private Space, Heroku patches the runtime and stack; on raw AWS, you patch nodes, AMIs, and control-plane versions yourself, or the platform you adopt does it for you.

Platform-level trust belongs in the threat model on either side. On April 7, 2022, a threat actor used a compromised token to download Heroku customers' GitHub integration OAuth tokens; by April 9 the attacker had cloned a subset of Heroku's own private GitHub repositories and a small number of customer repositories, and separately exfiltrated a database of customer account usernames with hashed and salted passwords. Heroku revoked the GitHub integration tokens on April 15, reset customer account passwords on May 5, and restored the integration later that month (Heroku incident review, GitHub write-up). Salesforce concluded GitHub itself was not breached. The point is not to relitigate it. The point is that when you do not hold the account, an incident in the vendor's account is your incident too.

One rule to carry out of this section: if an auditor needs to inspect your encryption keys and raw audit logs inside your own account, a Private Space cannot deliver that at any price tier.

Compliance and pricing details verified as of September 2026.

What networking do you actually get with Heroku Private Spaces vs an AWS VPC?

Heroku Private Spaces give you a real private network with VPC peering to an AWS VPC you control, Private Space DNS, internal app-to-app routing, Trusted IP Ranges, and stable outbound IPs (Heroku Private Spaces). It is a genuinely useful but bounded subset of a native AWS VPC, and the boundaries are documented, not opinions: the space is pinned to one region, you get no access to subnets or route tables, and there is no managed AWS Transit Gateway attachment.

The documented features are concrete. Peering connects dynos in a space to an AWS VPC you control, up to 5 VPCs per space, and the peered VPC must use an RFC1918 CIDR block that does not overlap the space's default ranges of 10.0.0.0/16, 10.1.0.0/16, and 172.17.0.0/16 (Private Space Peering). Trusted IP Ranges let you restrict inbound traffic to as many as 20 CIDR blocks (Trusted IP Ranges). All outbound traffic leaves through "a small, stable list of IP addresses dedicated to the space" (Heroku Private Spaces), which is what your partners allowlist. AWS PrivateLink exists too, but only for a specific case: connecting your VPC privately to Heroku Postgres running in a Private or Shield Space (Heroku Postgres via PrivateLink), not as a general attachment to the space's runtime network.

The hard limits are where AWS pulls ahead. The space runs in one region, chosen at creation. There is no managed AWS Transit Gateway attachment for hub-and-spoke topologies. You do not get to lay out subnets or edit route tables. On a native AWS VPC you get multi-VPC and multi-region topologies, AWS Transit Gateway hub-and-spoke, AWS PrivateLink for private access to AWS services and SaaS vendors, Route 53 private hosted zones, AWS WAF and Shield Advanced at the edge, and security groups and NACLs per tier.

Data gravity is the argument that actually moves teams. If your PostgreSQL, data warehouse, or Kafka already live in your own AWS account, peering them into a Private Space adds a hop, a failure mode, and a data transfer line item the native path does not have. Put a number on that hop: traffic that crosses an Availability Zone over a VPC peering connection is billed at $0.01 per GB in each direction, the same as cross-AZ transfer, and anything that has to exit to the internet is $0.09 per GB. A native workload sitting next to its database in the same AZ pays none of that.

Reach is not close. Heroku publishes 10 Private Spaces regions: Dublin, Frankfurt, London, Montreal, Mumbai, Oregon, Singapore, Sydney, Tokyo, and Virginia. AWS lists 39 Regions and 124 Availability Zones as of September 2026. On reliability, be precise about what is published: AWS commits to 99.95% monthly uptime for the standard Amazon EKS control plane and 99.99% for the provisioned tier, and 99.99% region-level and 99.5% instance-level for Amazon EC2. Heroku does not publish a public SLA uptime percentage for Private Spaces or Heroku Enterprise; those commitments live in the negotiated Enterprise agreement, and Heroku publishes historical uptime dashboards rather than a public contractual number (Heroku uptime).

Private Space networking becomes the binding constraint the moment you need a second region, a PrivateLink-only vendor wired into your runtime, or an existing AWS Transit Gateway hub.

How much does a Heroku Private Space cost per month compared with equivalent AWS infrastructure?

A Heroku Private Space is billed through fixed per-dyno list prices, starting at $125/month for a Private-S dyno with no discount levers, while AWS bills metered compute, storage, load balancing, and transfer that AWS Compute Savings Plans, Reserved Instances, and Spot can cut by published percentages. Heroku no longer publishes a standalone monthly space fee separate from the dynos; the space cost is carried in the Private dyno price, and Shield Space pricing is quote-based through Heroku's sales team. So Private Spaces cost more at list price in almost every worked example, and what you buy with the difference is operations you do not have to staff.

Heroku's published Private tiers, line by line (Heroku pricing): Private-S at $125/month (1 GB RAM), Private-M at $250 (2.5 GB), Private-L at $500 (14 GB), Private-L-RAM at $500 (30 GB), Private-XL at $750 (62 GB), and Private-2XL at $1,500 (126 GB). Shield dynos run higher, from $150 to $1,800. The private data services start well above their Common Runtime counterparts: private Heroku Postgres starts at Private-0 for $300/month, the private Key-Value Store (Redis) starts at Private-3 for $150/month, and private Apache Kafka starts at private-standard-0 for $1,800/month. For contrast, Common Runtime Heroku Postgres starts at $5/month for Essential-0 on the same pricing page.

The AWS equivalent, priced live, us-east-1: the Amazon EKS control plane at $0.10 per cluster-hour (about $73/month); EC2 m7i.large on-demand at $0.1008/hour (about $73.58/month), or m7g.large Graviton at $0.0816/hour, roughly 19% cheaper for the same 2 vCPU and 8 GB; AWS Fargate at $0.04048 per vCPU-hour and $0.004445 per GB-hour; Amazon RDS for PostgreSQL db.m7g.large single-AZ at $0.168/hour (about $122.64/month) plus gp3 storage at $0.115 per GB-month; an Application Load Balancer at $0.0225/hour plus $0.008 per LCU-hour; a NAT Gateway at $0.045/hour plus $0.045 per GB processed; EBS gp3 at $0.08 per GB-month; and internet egress at $0.09 per GB.

Here is one worked monthly example with the assumptions stated in the table. The shape is deliberately Heroku-friendly: steady load, a single region, nothing spiky.

Prices verified as of September 2026.

Two notes on that table so nobody feels the numbers were bent. The Compute Savings Plan discount is applied only to the EC2 node compute, because AWS Compute Savings Plans (up to 66%) cover EC2 and Fargate, not the EKS control plane, load balancing, NAT, storage, or egress. The published up-to-66% figure is the ceiling on longer, upfront commitments; a 1-year no-upfront plan discounts less, while RDS Reserved Instances, Graviton nodes, and Spot capacity (up to 90% off) for preview environments would pull the total down further. I left the database at list in the discounted column on purpose, so the contrast understates rather than overstates the AWS advantage.

The AWS side has a real hidden cost, and pretending otherwise is how these comparisons lose credibility. Someone has to run the platform. A DevOps engineer in the US has a median total compensation around $150,000 on Levels.fyi, and the Stack Overflow 2025 Developer Survey puts US cloud infrastructure engineers near a $189,000 median. Cloud-native skills are not sitting on the shelf either: the CNCF 2025 Annual Survey found 36% of organizations cite a lack of training as an adoption barrier, even as 82% of container users now run Kubernetes in production. That is the operations bill Heroku is quietly paying on your behalf.

The Heroku side has a hidden cost too, and it is structural. No Savings Plans, no Reserved Instances, no Spot, no Enterprise Discount Program, no committed-spend agreement, and no AWS Activate credits (up to $200,000 for eligible startups), because the cloud invoice is not in your name. When Flexera's 2026 State of the Cloud report puts estimated wasted cloud spend at 29%, the levers that claw it back are exactly the ones a Private Space cannot reach.

So who wins? Fixed-price Private Spaces win for small teams with few environments and steady load. Metered AWS wins for large, spiky, GPU-heavy, multi-region, or data-heavy workloads. The break-even is not a single magic number; it is an inequality. Roughly, stay on Heroku while your annual Private dyno plus private data spend is less than the loaded annual cost of the platform engineer you would hire to run AWS, plus the discounts you could apply once the invoice is yours. Cross that line and self-hosting wins on cash, not just on control.

That is also why the main decision comes down to more than price. Here is the full comparison, and Heroku wins the rows it genuinely wins.

Prices verified as of September 2026.

When should you stay on Heroku Private Spaces, and when should you move to AWS?

Stay in a Private Space while the fixed dyno bill costs less than a platform engineer and your workloads fit one region with Heroku-managed keys; move to your own AWS account when data gravity, unusable committed-spend discounts, region spread, instance families, or customer-managed AWS KMS requirements turn the platform boundary into your binding constraint. The trigger is rarely the raw compute delta. It is one capability you cannot get at any Heroku price tier.

Stay signals, as a scannable list:

• Your team is under roughly 20 engineers with no dedicated infrastructure owner.
• Heroku Shield with Salesforce as BAA signer already satisfies your compliance scope.
• Your app is single-region with predictable, steady load.
• One vendor invoice has real operational value to you.
• You have no committed-spend agreement or credits to burn down.

Move signals:

• You hold an AWS Enterprise Discount Program, a committed-spend agreement, or startup credits you cannot apply to a Heroku invoice.
• A vendor is PrivateLink-only, or you already run an AWS Transit Gateway hub.
• You need GPUs or specialized instance families.
• You need multi-region, or a cloud that is not AWS.
• A security review demands customer-managed AWS KMS keys.
• Your spend has crossed the point where a platform engineer costs less than the fixed dyno bill.

Be honest about what actually breaks in a migration, because that is where timelines blow up. Procfile and buildpack assumptions, add-on replacements, the ephemeral filesystem and dyno metadata behavior, release phase, Heroku Postgres extensions and follower databases, Heroku Scheduler, Heroku Connect, and the stable outbound IP allowlists your partners already hold: each of these is a small project. None is hard alone. Together they are the reason a "quick move" turns into a quarter.

A workable sequence in five steps:

• Containerize each service with a Dockerfile.
• Replace add-ons with managed cloud services (Amazon RDS, ElastiCache, MSK, and so on).
• Stand up networking, secrets, and IAM in your account.
• Cut traffic over service by service using DNS weighting.
• Decommission the space once nothing points at it.

I am not going to quote you a savings percentage from a stranger's blog. The direction and the drivers are what generalize: teams move for discount eligibility, region and instance flexibility, and key custody, and they save most when their load is spiky or their committed-spend discounts finally apply. If you want a concrete point of reference, we have written up how AI agents handled a 37-app Heroku-to-AWS migration in under two hours, with the mechanics laid out rather than a headline number.

One caution worth two lines: a half-finished AWS migration costs more than staying put, because you pay for both platforms plus the engineering time in between. Decide, sequence it, and finish it.

Is there a middle option between Heroku Private Spaces and raw AWS?

Yes. Bring-your-own-cloud internal developer platforms keep the git-push and preview-environment workflow while your containers, databases, and networking run inside your own cloud account, so you keep VPC design, AWS KMS key custody, CloudTrail ownership, and full AWS discount eligibility without hand-building the platform layer. Qovery, Northflank, and Porter all work this way.

The split is simple. The vendor operates the control plane; your account runs the data plane. Your VPC, your IAM, your keys, your CloudTrail, your invoice, and your Savings Plans all stay yours. You get the Heroku-style workflow on top of infrastructure you actually own.

Here is where Qovery fits. It deploys into your own AWS, GCP, Azure, or Scaleway account, or into an existing Kubernetes cluster, including self-managed and on-prem. You get git-push deploys, preview environments per pull request, environment auto-stop for non-production, managed cluster upgrades, per-environment RBAC, and databases backed by your cloud's own managed services. The workflow feels like Heroku. The account is yours.

The security consequence is concrete: your cloud account, VPC design, encryption keys, audit logs, and compliance attestations stay in your name, which is the exact part a Private Space structurally cannot hand over. To be clear, Qovery does not hold a compliance certification on your behalf; the posture inherits from your own cloud account and the controls you run inside it. The pricing consequence is just as concrete: AWS Compute Savings Plans, Reserved Instances, Spot, Enterprise Discount Programs, and startup credits all still apply, because the cloud invoice is in your name. That is why the BYOC column in the cost table can carry the discounted compute number in the first place.

Be fair about the alternatives, because they are real. Northflank and Porter also deploy into your own cloud account. Render and Fly.io are vendor-hosted, like Heroku. Aptible targets HIPAA-first managed hosting. AWS App Runner, Amazon ECS, and AWS Elastic Beanstalk are the AWS-native, do-it-yourself-lite options that live in your account but leave more of the platform work to you.

Be honest about the tradeoff, because BYOC is not free lunch. You own an AWS account and its blast radius, two invoices instead of one, a cross-account IAM role someone has to approve, and one person who understands your VPC. What you do not own is a whole platform team, and that is the trade most teams past a handful of services want to make.

How does Heroku Private Spaces compare with AWS for security, networking, and pricing?

On security, both run regulated workloads, but AWS lets you hold customer-managed AWS KMS keys and own raw CloudTrail logs in your account, while a Private Space keeps encryption and audit evidence with Salesforce. On networking, a Private Space gives you VPC peering and Trusted IP Ranges in one of 10 regions, while AWS gives you AWS Transit Gateway, AWS PrivateLink, and 39 regions. On pricing, Heroku charges fixed per-dyno list prices starting at $125/month for Private-S with no discounts, while AWS bills metered resources you can cut with Compute Savings Plans up to 66%.

Are Heroku Private Spaces HIPAA and PCI compliant, and who signs the BAA?

HIPAA and PCI DSS Level 1 are features of Heroku Shield, not standard Private Spaces, and Salesforce signs the Business Associate Addendum through its sales team (Heroku compliance). If you run your own AWS account instead, AWS signs a standard HIPAA BAA directly with you and publishes a maintained list of HIPAA-eligible services. The practical difference is who holds the attestations and the keys: with Shield that is Salesforce, with your own account that is you.

Can a Heroku Private Space connect privately to my own AWS VPC, and does it support AWS PrivateLink or Transit Gateway?

Yes to VPC peering: a Private Space can peer to an AWS VPC you control, up to 5 per space, as long as the peer uses a non-overlapping RFC1918 CIDR (Private Space Peering). AWS PrivateLink is supported only to connect your VPC to Heroku Postgres running in the space (Heroku Postgres via PrivateLink), not as a general attachment to the runtime, and there is no managed AWS Transit Gateway attachment. If you need a Transit Gateway hub or PrivateLink into the runtime itself, that is an AWS-account capability.

How much does a Heroku Private Space cost per month compared with equivalent AWS infrastructure?

Heroku bills fixed per-dyno prices starting at $125/month for a Private-S dyno, with private Postgres from $300/month, and no standalone space fee in the current pricing. In a worked example of 10 services across two environments with a Postgres primary and replica, that lands near $3,100/month, versus roughly $779/month building it yourself on AWS at on-demand list, or about $585/month with a 1-year Compute Savings Plan applied to compute. Heroku's price buys you zero platform operations; the AWS number assumes you or a platform have to run it.

Does Heroku run on AWS, and can I apply AWS Savings Plans, Reserved Instances, or committed-spend discounts to Heroku Private Spaces?

Yes, Heroku runs on AWS: its own security policy says the infrastructure is "hosted and managed within Amazon's secure data centers" (Heroku security policy), and the Fir generation runs on Amazon EKS (Heroku generations). But you cannot apply AWS Compute Savings Plans, Reserved Instances, Spot, or a committed-spend agreement to a Private Space, because the AWS invoice belongs to Salesforce, not to you. Those discounts only apply when the cloud account is in your name, which is the whole cost argument for running in your own account or through a BYOC platform.

Can I use customer-managed KMS keys and own my audit logs with Heroku Private Spaces?

No. In a Private Space, encryption is platform-managed and the audit trail belongs to Heroku, so you cannot inspect, rotate on your own schedule, or revoke the keys, and you cannot own the raw logs. In your own AWS account, a customer-managed AWS KMS key policy is "exclusively controlled by" you (AWS KMS developer guide), and CloudTrail logs sit in your account with retention and Amazon S3 Object Lock immutability you set. If an auditor needs to see keys and logs inside your account, that requirement alone rules out a Private Space.

What is the best alternative to Heroku Private Spaces if I want to keep my own AWS account?

If you want the Heroku workflow but your own account, a bring-your-own-cloud platform is the closest fit: Qovery, Northflank, and Porter all deploy git-push apps and per-PR preview environments into your AWS account (Qovery also supports GCP, Azure, Scaleway, and existing Kubernetes clusters). Because the invoice is in your name, your Savings Plans, keys, and CloudTrail logs stay yours. If you would rather stay fully AWS-native, AWS App Runner and AWS Elastic Beanstalk run in your account too, with more of the platform work left to you.

I have spent years watching teams weigh this exact call. Heroku Private Spaces are a good product, and for a small team in one region the fixed bill genuinely can cost less than the engineer you would hire to replace it. The moment your security review asks for your own keys, your finance team has discounts to burn, or your architecture needs a second region, the account boundary stops being an implementation detail and becomes the decision. That is the line to watch.