Blast Radius Reduction
The set of deliberate partitions — accounts, regions, zones, cells, tenants, deployment stages — that bound how far any single failure or compromise can reach.
Worth treating as a checklist, because the partitions are independent and most estates have some and not others:
Identity and account — separate cloud accounts per environment and per major workload, so a credential compromise or a runaway process is contained. The strongest boundary a cloud provider offers.
Network — segmentation by tier, with egress restricted as well as ingress.
Availability zone — the unit of correlated physical failure.
Region — for regulatory or catastrophic scope, at substantial cost.
Cell — a complete copy serving a slice of customers, bounding logical failures that zones and regions do not.
Tenant — quotas and shuffle sharding so one customer cannot consume shared capacity.
Deployment — canary and staged rollout so a bad release reaches a fraction before it reaches everyone; this is the partition that catches the most incidents, because most incidents are changes.
Operation — limits on what a single command or automation run can affect, which is what turns an operator error into a contained event.
The exercise worth doing explicitly: name the largest blast radius in the system out loud. It is usually a shared database, a shared identity, a global configuration push, or a pipeline with production credentials — and then decide deliberately whether to shrink it or accept it.