Why separation matters commercially
Mixing client workloads in one account makes it impossible to say cleanly what any individual client cost you. Attribution by tag helps, but it relies on discipline and breaks the moment somebody forgets.
It also makes handover awkward. When an engagement ends and the client wants their infrastructure, an account you can transfer is straightforward. Extracting one client’s resources from a shared account is a project.
Why separation matters technically
- A misconfiguration on one client’s workload cannot reach another’s
- Quotas are per account, so one client’s scale-up cannot throttle another’s
- Access can be granted per account, so a contractor sees only the project they are on
- A suspension or billing problem affects one engagement rather than all of them
- Audit logs are per account and therefore straightforward to hand over
Common structures
There are three arrangements that work, and the right one depends on who owns the relationship with the provider.
- The client owns the account and grants you access. Cleanest for handover; you depend on their billing being in order.
- You own an account per client and bill it through. Cleanest operationally; you carry the payment risk.
- An organisation or management group containing per-client accounts. Best of both at moderate scale, with consolidated billing and per-account isolation.
Plan the handover at the start
Agree at the beginning of an engagement what happens to the infrastructure at the end. Who owns the account, who holds the credentials, and what the transfer process looks like.
Defining infrastructure as code makes this dramatically easier, because the environment can be recreated in the client’s own account rather than transferred as an opaque set of resources.
Access hygiene across many accounts
With several accounts, per-account manual user management becomes a liability. Use whatever identity federation the provider supports so access is granted and removed centrally.
The test is simple: when a contractor finishes, how many places do you have to revoke access? If the answer is more than one, that is the problem to solve.
Related cloud accounts
This guide applies across providers. The cloud account catalogue lists every platform with its configurations and prices, and the comparison table puts them side by side.
Further reading
- Managed Database or Self-Hosted: An Honest Comparison
- Linode vs UpCloud: Which Cloud Account Should You Buy?
- Oracle Cloud vs Hetzner: Which Cloud Account Should You Buy?
- DigitalOcean vs Hetzner: Which Cloud Account Should You Buy?
Frequently asked questions
Rarely. The overhead is small and it removes attribution and handover problems entirely.
Ideally by recreating it from code in the client's own account. Transferring an account is possible but subject to the provider's terms.
Whichever party owns the account. Agree this at the start, because changing it mid-engagement is disruptive.
