Yep, it's a complicated beast so I'd love to be able to mess around with it locally! I don't mind using an AWS account for a shared staging environment in the CI pipeline, but trying to figure out policies and roles during development, it can get a bit messy coordinating and handling the lifecycle of resources in a team's testing account (maybe this is easier if you get your own account?). And accounts aren't free when they require GuardDuty etc, unfortunately.
reply> accounts aren't free when they require GuardDuty etc, unfortunately
replyThis is probably the root of your problems. In principle, non-production accounts should have vastly reduced security requirements. Personally, I can't understand how companies are OK with offering more-or-less unrestricted guest WiFi (which, of course, has no access to production systems, let alone internal systems), but somehow offering minimally restricted AWS accounts (basically, just slap billing alarms on, maybe common-sense SCP-based restrictions like no public IPv4) for development purposes is problematic?