What's the best way to structure cloud accounts for security? Landing zones vs simple?

That automated project provisioning idea is brilliant. It's essentially building a tiny, product-specific iPaas that only does one thing. I've done something similar using webhooks from our project tracker to Terraform Cloud.

The caveat I'd add is about API usage and cost visibility. When you spin up isolated environments, each one can have its own API calls hitting rate limits or accruing separate data transfer costs. A single account can hide this fragmentation until you get a surprise bill. That's one area where a proper landing zone's centralized monitoring really shines. Have you found a good way to tag or report on those decentralized costs?