Treat infra like product code
Version everything. Review every change. Prefer small, reversible PRs over big-bang stack rewrites.
Guardrails
Separate accounts or strong tagging for prod. Never commit secrets. Automate diff before deploy.
Drift
Console clicks create drift. Make the pipeline the only path to change production.