Create an environment and identity separation plan

Environment labels inside one account do not create a security boundary. Development code, identities and datasets change more freely than production, so they should not share broad credentials or implicit network paths.

Build the decision artifact

Create an environment matrix covering account or project, network, data class, service principal, secret store, encryption key, observability access and deploy authority. Use workload identity or short-lived credentials where possible. Promote artifacts through environments; do not copy production credentials backward.

The enterprise delivery lab makes this reasoning executable with synthetic data:

from enterprise_cases import environment_identity_case

result = environment_identity_case()
assert result["unique_principals"] == 3
assert result["shared_secret"] is False
assert result["prod_access_from_dev"] is False
assert result["matrix"]["dev"]["data"] == "synthetic"

The lab assigns three different accounts and principals. Development uses synthetic data and cannot reach production. Staging uses masked data. The shared_secret check makes credential reuse visible instead of relying on naming conventions.

Test the failure path

Separation fails through side channels: a shared vector index, central cache, CI credential, logging sink or developer support role. Test effective permissions from each principal. Record emergency access, approval, expiry and audit rather than leaving an undocumented permanent path.

Save evidence that another reviewer can inspect:

• environment boundary matrix
• effective-permission test results
• artifact promotion and secret rotation flow
• break-glass access record and expiry

This exercise aligns with the enterprise delivery, secure integration, operations and leadership work in the FDE for Professionals course. The course link describes the pathway; this local draft and its synthetic verifier do not claim that a client deployment, security approval or production result occurred.

Practice task

List every shared service across three environments. For each, prove how data and identity stay separated or replace it with an environment-specific instance.

Continue learning

This article is part of the Enterprise AI delivery and architecture sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Choose serverless, workers or containers from workload constraints.
• Continue with Design an approval inbox with explicit ownership.

Reference: AWS Well-Architected Security Pillar.