You are not the only one to have this thought. The problem is - who comes and fixes the mess when the inevitable customizations needed have been done by a contractor who is now long gone? It seems like a great idea at the beginning, but at some point someone ends up responsible for a fleet of AWS accounts that have diverged in different odd ways. Who is that someone? Individual departments? A centralized department?

The latter sounds nice except for the lack of appetite (on both sides of the atlantic) for doing what's necessary to recruit and keep SREs as actual government employees rather than just contracting everything out...