A CSP I'm familiar with deploys SaaS to multiple regions, on another CSP's IaaS/PaaS. Each region is isolated in its own I/PaaS account, leading to a lot of manual duplication, as any configuration or other operation in one region has to be duplicated across all the others. Some of this could perhaps be automated, but a lot of the work is ad-hoc, and strict security boundaries generally make it impossible for any automation to access multiple accounts (user accounts for the operators are not restricted).
The justification for this segregation is security - they want to restrict the potential damage in the event that a miscreant gains access to one of the accounts. This could come about through e.g. some catastrophic compromise of the SaaS, or if the miscreant is somehow able to authorise a new user or API key. In any case, this only makes sense when it is impossible for the same breach to be replicated by an attacker across other regions, or if they're expecting to detect the compromise and block it globally first.
The operations people are, needless to say, none to pleased with all of the tedious manual duplication. What do you think? Is this a valid threat model? Are the security benefits worth the operational cost?
