How do you manage multiple cloud accounts in IaC configurations?

Managing multiple cloud accounts in Infrastructure as Code is crucial, primarily for achieving environment isolation (e.g., development, production), enhancing security boundaries, meeting compliance requirements, and optimizing cost allocation. This effectively prevents configuration drift and improves the efficiency of large-scale cloud resource management.

The core approach is to adopt modular design and use variables to dynamically inject account credentials or role information. Key steps include:

1. Abstract configuration: Extract differences such as cloud account IDs and regions into variables (e.g., Terraform's `variables`).

2. Centralized credential management: Use secret managers or CI/CD variables to securely store access keys and avoid hardcoding. Combine AWS IAM roles, GCP service accounts, or Azure Managed Identity for temporary permission requests.

3. State isolation: Use independent IaC state backends for each account/environment.

4. Module reuse: Write common infrastructure modules and deploy them to different accounts by passing different variable values.

A typical implementation process:

1. Plan the account structure at the organizational level.

2. Use tool layers (e.g., Terraform Cloud, Spacelift) or workspaces to separate configurations and executions of different accounts.

3. Define variable files (e.g., `dev.tfvars`, `prod.tfvars`) to provide parameterized inputs for each account.

4. Select credentials and variable files as needed in the CI/CD pipeline to trigger deployment.

5. Strictly enforce the principle of least privilege and automated auditing.

Ultimately, consistent, secure, and auditable multi-account infrastructure management capabilities are achieved.