This is a great advertisement for Google Cloud. Google Cloud's security model is much simpler. For the 95% case, you can have different projects for each app and environment, and assign access permissions per project. Then you can gradually add in shared resource access when you need it. To get the same kind of isolation by default with AWS, you need to have multiple AWS accounts (AFAIK), which is a giant pain.