S3 server access logs could only land in an AES256 bucket for years, and AES256 is exactly what Security Hub flags. The escape was never a bucket setting. It was a KMS key policy that lets the logging service write with your key.
Multi-tenancy on a data platform is usually a ticket and a week of console clicking. We made it a Terraform apply: a workspace, its catalog, its groups, its grants, and its dbt project — isolated by construction, reviewed in a pull request.
A Terraform provider for the platform's own resources — warehouses, namespaces, grants, dbt projects, contracts, ontologies — managed in HCL, in a repo, in a pull request, with a plan you can read before you apply.