At work, we have a Terraform module that receives a few input parameters and generates a VPC that complies with all of our corporate security guidelines. The module isn't complicated, and it ensures that we get it right every time.

We do this for every commonly-used AWS resource -- S3 buckets, SQS queues, etc. It eliminates most of the risk of misconfiguration, allows our infrastructure changes to be code-reviewed and unit tested, and eliminates a lot of the fiddly crap work associated with setting up something on AWS.

I do some volunteer IT work for the nonprofit makerspace in my town, and I obviously don't have access to my employer's tool chain if I have to work in their AWS account. It really is a night-and-day difference.