Many engineers start learning Terraform with separate folders for dev, staging, and production environments. That structure helps organization, but it does not determine where Terraform deploys resources.
The actual deployment target is selected by the provider configuration and the credentials behind it. Provider aliases and AssumeRole define the account boundary. The repository layout is only documentation for humans.
In this lesson, we examine AWS accounts as security boundaries, how provider aliases create separate deployment paths, why environment identity should exist as configuration data, and how modules can be safely reused across multiple accounts.
Understanding this distinction helps prevent one of the most common misconceptions in multi-account Terraform design: confusing repository structure with account isolation.