diff --git a/Makefile b/Makefile
index f29c735cb..6200a1048 100644
--- a/Makefile
+++ b/Makefile
@@ -33,6 +33,19 @@ else
   GO_BUILD_MOD :=
 endif
 
+# Quiet-mode filters (active when QUIET=1, set by preflight via recursive make)
+ifdef QUIET
+  _Q     = @
+  _COVQ  = 2>&1 | grep -Ev '^\s*(ok|PASS|\?|=== RUN|--- PASS:)\s' | grep -v 'coverage: 0\.0%' || true
+  _RACEQ = 2>&1 | { grep -Ev '^\s*(ok|PASS|\?|=== RUN|--- PASS:)\s' || true; }; exit $${PIPESTATUS[0]}
+  _SECQ  = >
+else
+  _Q     =
+  _COVQ  = || true
+  _RACEQ =
+  _SECQ  = 2>&1 | tee
+endif
+
 build:
 	$(MAKE) go_build
 
@@ -52,7 +65,8 @@ go_run:
 
 # Preflight — runs the same checks as GitHub Actions (format + lint + security + tests).
 # Use this before committing to catch CI failures locally.
-preflight: check-format check-modernize vet security-check test-cover diff-coverage test-race
+preflight:
+	@$(MAKE) --no-print-directory QUIET=1 check-format check-modernize vet security-check test-cover diff-coverage test-race
 	@echo -e "\n ✅ Preflight passed — safe to commit."
 
 # Run unit tests
@@ -64,33 +78,20 @@ test:
 # Note: go test may exit non-zero due to Go version mismatch in coverage instrumentation
 # for packages without test files. We check actual test results + coverage threshold instead.
 COVERPROFILE ?= coverage.out
-MIN_COVERAGE ?= 50.0
+MIN_COVERAGE ?= 60.0
 test-cover:
 	@echo -e "\n....Running tests with coverage for $(GO_PROJECT_NAME)...."
-	LOG_IGNORE=1 go test -timeout 120s -coverprofile=$(COVERPROFILE) -covermode=atomic ./hive/... || true
-	@echo ""
-	@echo "=== Total Coverage ==="
-	@go tool cover -func=$(COVERPROFILE) | tail -1
-	@TOTAL=$$(go tool cover -func=$(COVERPROFILE) | tail -1 | awk '{print $$NF}' | tr -d '%'); \
-	if [ -z "$$TOTAL" ] || [ ! -s $(COVERPROFILE) ]; then \
-		echo "ERROR: No coverage data generated — tests may have failed to compile"; \
-		exit 1; \
-	fi; \
-	PASS=$$(echo "$$TOTAL >= $(MIN_COVERAGE)" | bc -l); \
-	if [ "$$PASS" != "1" ]; then \
-		echo "ERROR: Total coverage $${TOTAL}% is below minimum $(MIN_COVERAGE)%"; \
-		exit 1; \
-	fi; \
-	echo "Coverage $${TOTAL}% meets minimum $(MIN_COVERAGE)% threshold"
+	$(_Q)LOG_IGNORE=1 go test -timeout 120s -coverprofile=$(COVERPROFILE) -covermode=atomic ./hive/... $(_COVQ)
+	@scripts/check-coverage.sh $(COVERPROFILE) $(MIN_COVERAGE) $(QUIET)
 
 # Run unit tests with race detector
 test-race:
 	@echo -e "\n....Running tests with race detector for $(GO_PROJECT_NAME)...."
-	LOG_IGNORE=1 go test -race -timeout 300s ./hive/...
+	$(_Q)LOG_IGNORE=1 go test -race -timeout 300s ./hive/... $(_RACEQ)
 
 # Check that new/changed code meets coverage threshold (runs tests first)
 diff-coverage: test-cover
-	@scripts/diff-coverage.sh $(COVERPROFILE)
+	@QUIET=$(QUIET) scripts/diff-coverage.sh $(COVERPROFILE)
 
 bench:
 	@echo -e "\n....Running benchmarks for $(GO_PROJECT_NAME)...."
@@ -158,7 +159,7 @@ check-format:
 # Go vet (fails on issues, matches CI)
 vet:
 	@echo "Running go vet..."
-	go vet ./...
+	$(_Q)go vet ./...
 	@echo "  go vet ok"
 
 # Excluded: newexpr (replaces aws.String with new, not idiomatic for AWS SDK)
@@ -186,11 +187,11 @@ check-modernize:
 # Reports are also saved to tests/ for review.
 security-check:
 	@echo -e "\n....Running security checks for $(GO_PROJECT_NAME)...."
-	set -o pipefail && go tool govulncheck ./... 2>&1 | tee tests/govulncheck-report.txt
+	$(_Q)set -o pipefail && go tool govulncheck ./... $(_SECQ) tests/govulncheck-report.txt $(if $(QUIET),|| { cat tests/govulncheck-report.txt; exit 1; })
 	@echo "  govulncheck ok"
-	set -o pipefail && go tool gosec -quiet -exclude=G204,G304,G402 -exclude-generated -exclude-dir=cmd ./... 2>&1 | tee tests/gosec-report.txt
+	$(_Q)set -o pipefail && go tool gosec -quiet -exclude=G204,G304,G402 -exclude-generated -exclude-dir=cmd ./... $(_SECQ) tests/gosec-report.txt $(if $(QUIET),|| { cat tests/gosec-report.txt; exit 1; })
 	@echo "  gosec ok"
-	set -o pipefail && go tool staticcheck -checks="all,-ST1000,-ST1003,-ST1016,-ST1020,-ST1021,-ST1022,-SA1019,-SA9005" ./... 2>&1 | tee tests/staticcheck-report.txt
+	$(_Q)set -o pipefail && go tool staticcheck -checks="all,-ST1000,-ST1003,-ST1016,-ST1020,-ST1021,-ST1022,-SA1019,-SA9005" ./... $(_SECQ) tests/staticcheck-report.txt $(if $(QUIET),|| { cat tests/staticcheck-report.txt; exit 1; })
 	@echo "  staticcheck ok"
 
 # Docker E2E tests (mirrors GitHub Actions e2e.yml)
diff --git a/hive/daemon/daemon.go b/hive/daemon/daemon.go
index fc061f800..630278ded 100644
--- a/hive/daemon/daemon.go
+++ b/hive/daemon/daemon.go
@@ -486,7 +486,7 @@ func (d *Daemon) Start() error {
 
 	// Ensure default VPC exists (matches AWS: every account has a default VPC)
 	if d.vpcService != nil {
-		if err := d.vpcService.EnsureDefaultVPC(); err != nil {
+		if err := d.vpcService.EnsureDefaultVPC(handlers_ec2_vpc.GlobalAccountID); err != nil {
 			slog.Warn("Failed to ensure default VPC", "error", err)
 		}
 	}
@@ -1361,7 +1361,7 @@ func (d *Daemon) stopInstance(instances map[string]*vm.VM, deleteVolume bool) er
 					slog.Info("Deleting volume with DeleteOnTermination=true", "name", ebsRequest.Name, "id", instance.ID)
 					_, err := d.volumeService.DeleteVolume(&ec2.DeleteVolumeInput{
 						VolumeId: &ebsRequest.Name,
-					})
+					}, instance.AccountID)
 					if err != nil {
 						slog.Error("Failed to delete volume on termination", "name", ebsRequest.Name, "id", instance.ID, "err", err)
 					} else {
@@ -1382,7 +1382,7 @@ func (d *Daemon) stopInstance(instances map[string]*vm.VM, deleteVolume bool) er
 			if deleteVolume && instance.ENIId != "" && d.vpcService != nil {
 				_, eniErr := d.vpcService.DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{
 					NetworkInterfaceId: &instance.ENIId,
-				})
+				}, instance.AccountID)
 				if eniErr != nil {
 					slog.Warn("Failed to delete ENI on termination", "eni", instance.ENIId, "err", eniErr)
 				} else {
diff --git a/hive/daemon/daemon_handlers.go b/hive/daemon/daemon_handlers.go
index 15ac63226..786222fd1 100644
--- a/hive/daemon/daemon_handlers.go
+++ b/hive/daemon/daemon_handlers.go
@@ -22,8 +22,9 @@ func respondWithError(msg *nats.Msg, errCode string) {
 }
 
 // handleNATSRequest is a generic helper for the common unmarshal → service → marshal → respond pattern.
-// used for basic requests that don't modify any daemon state, just return the result
-func handleNATSRequest[I any, O any](msg *nats.Msg, serviceFn func(*I) (*O, error)) {
+// It extracts the account ID from the NATS message header and passes it to the service function.
+func handleNATSRequest[I any, O any](msg *nats.Msg, serviceFn func(*I, string) (*O, error)) {
+	accountID := utils.AccountIDFromMsg(msg)
 	input := new(I)
 	if errResp := utils.UnmarshalJsonPayload(input, msg.Data); errResp != nil {
 		if err := msg.Respond(errResp); err != nil {
@@ -31,7 +32,7 @@ func handleNATSRequest[I any, O any](msg *nats.Msg, serviceFn func(*I) (*O, erro
 		}
 		return
 	}
-	output, err := serviceFn(input)
+	output, err := serviceFn(input, accountID)
 	if err != nil {
 		if err := msg.Respond(utils.GenerateErrorPayload(awserrors.ValidErrorCode(err.Error()))); err != nil {
 			slog.Error("Failed to respond to NATS request", "err", err)
@@ -72,6 +73,14 @@ func (d *Daemon) handleEC2Events(msg *nats.Msg) {
 		return
 	}
 
+	// Verify the caller owns this instance (skip for pre-Phase4 instances with no AccountID)
+	callerAccountID := utils.AccountIDFromMsg(msg)
+	if callerAccountID != "" && instance.AccountID != "" && instance.AccountID != callerAccountID {
+		slog.Warn("Account does not own this instance", "instanceId", command.ID, "callerAccount", callerAccountID, "ownerAccount", instance.AccountID)
+		respondWithError(msg, awserrors.ErrorInvalidInstanceIDNotFound)
+		return
+	}
+
 	switch {
 	case command.Attributes.AttachVolume:
 		d.handleAttachVolume(msg, command, instance)
diff --git a/hive/daemon/daemon_handlers_console.go b/hive/daemon/daemon_handlers_console.go
index df724f42e..7471b0cba 100644
--- a/hive/daemon/daemon_handlers_console.go
+++ b/hive/daemon/daemon_handlers_console.go
@@ -32,6 +32,7 @@ func (d *Daemon) handleEC2GetConsoleOutput(msg *nats.Msg) {
 	}
 
 	instanceID := *input.InstanceId
+	accountID := utils.AccountIDFromMsg(msg)
 
 	// Find the instance on this node
 	d.Instances.Mu.Lock()
@@ -43,6 +44,12 @@ func (d *Daemon) handleEC2GetConsoleOutput(msg *nats.Msg) {
 		return
 	}
 
+	// Verify the caller owns this instance
+	if accountID != "" && instance.AccountID != "" && instance.AccountID != accountID {
+		respondWithError(msg, awserrors.ErrorInvalidInstanceIDNotFound)
+		return
+	}
+
 	logPath := instance.Config.ConsoleLogPath
 	var outputData []byte
 	var modTime time.Time
diff --git a/hive/daemon/daemon_handlers_image.go b/hive/daemon/daemon_handlers_image.go
index a77b37532..769625daa 100644
--- a/hive/daemon/daemon_handlers_image.go
+++ b/hive/daemon/daemon_handlers_image.go
@@ -29,6 +29,8 @@ func (d *Daemon) handleEC2CreateImage(msg *nats.Msg) {
 		return
 	}
 
+	accountID := utils.AccountIDFromMsg(msg)
+
 	if input.InstanceId == nil || *input.InstanceId == "" {
 		respondWithError(msg, awserrors.ErrorMissingParameter)
 		return
@@ -63,6 +65,13 @@ func (d *Daemon) handleEC2CreateImage(msg *nats.Msg) {
 		return
 	}
 
+	// Verify the caller owns this instance
+	if accountID != "" && instance.AccountID != "" && instance.AccountID != accountID {
+		slog.Warn("CreateImage: account does not own instance", "instanceId", instanceID, "accountID", accountID, "ownerAccountID", instance.AccountID)
+		respondWithError(msg, awserrors.ErrorInvalidInstanceIDNotFound)
+		return
+	}
+
 	if status != vm.StateRunning && status != vm.StateStopped {
 		slog.Warn("CreateImage: instance not in valid state", "instanceId", instanceID, "status", status)
 		respondWithError(msg, awserrors.ErrorIncorrectInstanceState)
@@ -82,7 +91,7 @@ func (d *Daemon) handleEC2CreateImage(msg *nats.Msg) {
 		IsRunning:     status == vm.StateRunning,
 	}
 
-	output, err := d.imageService.CreateImageFromInstance(params)
+	output, err := d.imageService.CreateImageFromInstance(params, accountID)
 	if err != nil {
 		slog.Error("CreateImage: service failed", "instanceId", instanceID, "err", err)
 		respondWithError(msg, awserrors.ValidErrorCode(err.Error()))
diff --git a/hive/daemon/daemon_handlers_instance.go b/hive/daemon/daemon_handlers_instance.go
index 396b1e86b..927fb17da 100644
--- a/hive/daemon/daemon_handlers_instance.go
+++ b/hive/daemon/daemon_handlers_instance.go
@@ -23,6 +23,14 @@ func (d *Daemon) handleEC2RunInstances(msg *nats.Msg) {
 	slog.Debug("Received message on subject", "subject", msg.Subject)
 	slog.Debug("Message data", "data", string(msg.Data))
 
+	// Extract account ID from NATS header
+	accountID := utils.AccountIDFromMsg(msg)
+	if accountID == "" {
+		slog.Error("handleEC2RunInstances: missing account ID in NATS header")
+		respondWithError(msg, awserrors.ErrorServerInternal)
+		return
+	}
+
 	// Initialize runInstancesInput before unmarshaling into it
 	runInstancesInput := &ec2.RunInstancesInput{}
 	errResp := utils.UnmarshalJsonPayload(runInstancesInput, msg.Data)
@@ -56,15 +64,38 @@ func (d *Daemon) handleEC2RunInstances(msg *nats.Msg) {
 		respondWithError(msg, awserrors.ErrorServerInternal)
 		return
 	}
-	if _, err := d.imageService.GetAMIConfig(*runInstancesInput.ImageId); err != nil {
+	amiMeta, err := d.imageService.GetAMIConfig(*runInstancesInput.ImageId)
+	if err != nil {
 		slog.Error("handleEC2RunInstances AMI not found", "imageId", *runInstancesInput.ImageId, "err", err)
 		respondWithError(msg, awserrors.ErrorInvalidAMIIDNotFound)
 		return
 	}
+	// Verify the caller can use this AMI: must own it or it must be a system/pre-phase4 AMI.
+	// System AMIs have non-account-ID owner aliases (e.g. "self", "hive", empty).
+	amiOwner := amiMeta.ImageOwnerAlias
+	if amiOwner != "" && amiOwner != accountID {
+		// Check if this is a system/pre-phase4 AMI (non-account-ID owner)
+		isSystem := len(amiOwner) != 12
+		if !isSystem {
+			allDigits := true
+			for _, c := range amiOwner {
+				if c < '0' || c > '9' {
+					allDigits = false
+					break
+				}
+			}
+			isSystem = !allDigits
+		}
+		if !isSystem {
+			slog.Warn("handleEC2RunInstances AMI not owned by caller", "imageId", *runInstancesInput.ImageId, "amiOwner", amiOwner, "accountID", accountID)
+			respondWithError(msg, awserrors.ErrorInvalidAMIIDNotFound)
+			return
+		}
+	}
 
 	// Validate key pair exists (if specified)
 	if runInstancesInput.KeyName != nil && *runInstancesInput.KeyName != "" {
-		if err := d.keyService.ValidateKeyPairExists(*runInstancesInput.KeyName); err != nil {
+		if err := d.keyService.ValidateKeyPairExists(accountID, *runInstancesInput.KeyName); err != nil {
 			slog.Error("handleEC2RunInstances key pair not found", "keyName", *runInstancesInput.KeyName, "err", err)
 			respondWithError(msg, awserrors.ErrorInvalidKeyPairNotFound)
 			return
@@ -142,7 +173,7 @@ func (d *Daemon) handleEC2RunInstances(msg *nats.Msg) {
 			eniOut, eniErr := d.vpcService.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 				SubnetId:    runInstancesInput.SubnetId,
 				Description: aws.String("Primary network interface for " + instance.ID),
-			})
+			}, accountID)
 			if eniErr != nil {
 				slog.Error("handleEC2RunInstances auto-create ENI failed", "instanceId", instance.ID, "subnetId", *runInstancesInput.SubnetId, "err", eniErr)
 				lastRunErr = eniErr
@@ -205,12 +236,13 @@ func (d *Daemon) handleEC2RunInstances(msg *nats.Msg) {
 	// Build reservation with all instances
 	reservation := ec2.Reservation{}
 	reservation.SetReservationId(utils.GenerateResourceID("r"))
-	reservation.SetOwnerId("123456789012") // TODO: Use actual owner ID from config
+	reservation.SetOwnerId(accountID)
 	reservation.Instances = allEC2Instances
 
-	// Store reservation reference in all VMs
+	// Store reservation reference and account ID in all VMs
 	for _, instance := range instances {
 		instance.Reservation = &reservation
+		instance.AccountID = accountID
 	}
 
 	// Respond to NATS immediately with reservation (instances are provisioning)
@@ -443,10 +475,13 @@ func (d *Daemon) handleStopOrTerminateInstance(msg *nats.Msg, command qmp.Comman
 }
 
 // handleEC2DescribeInstances processes incoming EC2 DescribeInstances requests
-// This handler responds with all instances running on this node
+// This handler responds with instances running on this node owned by the caller's account
 func (d *Daemon) handleEC2DescribeInstances(msg *nats.Msg) {
 	slog.Debug("Received message", "subject", msg.Subject, "data", string(msg.Data))
 
+	// Extract account ID from NATS header for scoping
+	accountID := utils.AccountIDFromMsg(msg)
+
 	// Initialize describeInstancesInput before unmarshaling into it
 	describeInstancesInput := &ec2.DescribeInstancesInput{}
 	errResp := utils.UnmarshalJsonPayload(describeInstancesInput, msg.Data)
@@ -459,7 +494,7 @@ func (d *Daemon) handleEC2DescribeInstances(msg *nats.Msg) {
 		return
 	}
 
-	slog.Info("Processing DescribeInstances request from this node")
+	slog.Info("Processing DescribeInstances request from this node", "accountID", accountID)
 
 	d.Instances.Mu.Lock()
 	defer d.Instances.Mu.Unlock()
@@ -483,6 +518,12 @@ func (d *Daemon) handleEC2DescribeInstances(msg *nats.Msg) {
 
 	// Iterate through all instances on this node
 	for _, instance := range d.Instances.VMS {
+		// Skip instances not owned by the caller's account.
+		// Pre-Phase4 instances (empty AccountID) are visible to all accounts.
+		if accountID != "" && instance.AccountID != "" && instance.AccountID != accountID {
+			continue
+		}
+
 		// Skip if filtering by instance IDs and this instance is not in the filter
 		if len(instanceIDFilter) > 0 && !instanceIDFilter[instance.ID] {
 			continue
@@ -613,6 +654,8 @@ type startStoppedInstanceRequest struct {
 // handleEC2StartStoppedInstance picks up a stopped instance from shared KV,
 // re-launches it on this daemon node, and removes it from shared KV.
 func (d *Daemon) handleEC2StartStoppedInstance(msg *nats.Msg) {
+	// Extract account ID from NATS header for ownership verification
+	callerAccountID := utils.AccountIDFromMsg(msg)
 
 	var req startStoppedInstanceRequest
 	if err := json.Unmarshal(msg.Data, &req); err != nil {
@@ -652,6 +695,13 @@ func (d *Daemon) handleEC2StartStoppedInstance(msg *nats.Msg) {
 		return
 	}
 
+	// Verify the caller owns this instance
+	if callerAccountID != "" && instance.AccountID != "" && instance.AccountID != callerAccountID {
+		slog.Warn("handleEC2StartStoppedInstance: account does not own instance", "instanceId", req.InstanceID, "callerAccount", callerAccountID, "ownerAccount", instance.AccountID)
+		respondWithError(msg, awserrors.ErrorInvalidInstanceIDNotFound)
+		return
+	}
+
 	// Reset node-local fields that are stale after cross-node migration
 	instance.ResetNodeLocalState()
 
@@ -719,6 +769,8 @@ type terminateStoppedInstanceRequest struct {
 // handleEC2TerminateStoppedInstance picks up a stopped instance from shared KV,
 // deletes its volumes, and removes it from shared KV.
 func (d *Daemon) handleEC2TerminateStoppedInstance(msg *nats.Msg) {
+	// Extract account ID from NATS header for ownership verification
+	callerAccountID := utils.AccountIDFromMsg(msg)
 
 	var req terminateStoppedInstanceRequest
 	if err := json.Unmarshal(msg.Data, &req); err != nil {
@@ -758,6 +810,13 @@ func (d *Daemon) handleEC2TerminateStoppedInstance(msg *nats.Msg) {
 		return
 	}
 
+	// Verify the caller owns this instance
+	if callerAccountID != "" && instance.AccountID != "" && instance.AccountID != callerAccountID {
+		slog.Warn("handleEC2TerminateStoppedInstance: account does not own instance", "instanceId", req.InstanceID, "callerAccount", callerAccountID, "ownerAccount", instance.AccountID)
+		respondWithError(msg, awserrors.ErrorInvalidInstanceIDNotFound)
+		return
+	}
+
 	// Delete volumes — no QEMU shutdown or unmount needed (already done during stop)
 	instance.EBSRequests.Mu.Lock()
 	for _, ebsRequest := range instance.EBSRequests.Requests {
@@ -786,7 +845,7 @@ func (d *Daemon) handleEC2TerminateStoppedInstance(msg *nats.Msg) {
 		slog.Info("handleEC2TerminateStoppedInstance: deleting volume with DeleteOnTermination=true", "name", ebsRequest.Name)
 		_, err := d.volumeService.DeleteVolume(&ec2.DeleteVolumeInput{
 			VolumeId: &ebsRequest.Name,
-		})
+		}, instance.AccountID)
 		if err != nil {
 			slog.Error("handleEC2TerminateStoppedInstance: failed to delete volume", "name", ebsRequest.Name, "err", err)
 		}
@@ -815,6 +874,9 @@ func (d *Daemon) handleEC2DescribeStoppedInstances(msg *nats.Msg) {
 		return
 	}
 
+	// Extract account ID from NATS header for scoping
+	accountID := utils.AccountIDFromMsg(msg)
+
 	// Parse optional filters from the request
 	describeInput := &ec2.DescribeInstancesInput{}
 	if len(msg.Data) > 0 {
@@ -847,6 +909,12 @@ func (d *Daemon) handleEC2DescribeStoppedInstances(msg *nats.Msg) {
 	reservationMap := make(map[string]*ec2.Reservation)
 
 	for _, instance := range instances {
+		// Skip instances not owned by the caller's account.
+		// Pre-Phase4 instances (empty AccountID) are visible to all accounts.
+		if accountID != "" && instance.AccountID != "" && instance.AccountID != accountID {
+			continue
+		}
+
 		// Apply instance ID filter
 		if len(instanceIDFilter) > 0 && !instanceIDFilter[instance.ID] {
 			continue
@@ -909,6 +977,8 @@ func (d *Daemon) handleEC2DescribeStoppedInstances(msg *nats.Msg) {
 // handleEC2ModifyInstanceAttribute modifies attributes of a stopped instance in shared KV.
 // All supported attributes (InstanceType, UserData) require the instance to be stopped.
 func (d *Daemon) handleEC2ModifyInstanceAttribute(msg *nats.Msg) {
+	// Extract account ID from NATS header for ownership verification
+	callerAccountID := utils.AccountIDFromMsg(msg)
 
 	var input ec2.ModifyInstanceAttributeInput
 	if err := json.Unmarshal(msg.Data, &input); err != nil {
@@ -949,6 +1019,13 @@ func (d *Daemon) handleEC2ModifyInstanceAttribute(msg *nats.Msg) {
 		return
 	}
 
+	// Verify the caller owns this instance
+	if callerAccountID != "" && instance.AccountID != "" && instance.AccountID != callerAccountID {
+		slog.Warn("handleEC2ModifyInstanceAttribute: account does not own instance", "instanceId", instanceID, "callerAccount", callerAccountID, "ownerAccount", instance.AccountID)
+		respondWithError(msg, awserrors.ErrorInvalidInstanceIDNotFound)
+		return
+	}
+
 	// Apply the requested attribute change
 	if input.InstanceType != nil && input.InstanceType.Value != nil {
 		newType := *input.InstanceType.Value
diff --git a/hive/daemon/daemon_handlers_tag.go b/hive/daemon/daemon_handlers_tag.go
index 743db9026..2a20c6bca 100644
--- a/hive/daemon/daemon_handlers_tag.go
+++ b/hive/daemon/daemon_handlers_tag.go
@@ -1,8 +1,6 @@
 package daemon
 
-import (
-	"github.com/nats-io/nats.go"
-)
+import "github.com/nats-io/nats.go"
 
 func (d *Daemon) handleEC2CreateTags(msg *nats.Msg) {
 	handleNATSRequest(msg, d.tagsService.CreateTags)
diff --git a/hive/daemon/daemon_handlers_test.go b/hive/daemon/daemon_handlers_test.go
index 0760af67a..c81c37de6 100644
--- a/hive/daemon/daemon_handlers_test.go
+++ b/hive/daemon/daemon_handlers_test.go
@@ -34,6 +34,17 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// testAccountID is the default account ID used in daemon tests.
+const testAccountID = "123456789012"
+
+// natsRequest sends a NATS request with the X-Account-ID header set.
+func natsRequest(nc *nats.Conn, subject string, data []byte, timeout time.Duration) (*nats.Msg, error) {
+	msg := nats.NewMsg(subject)
+	msg.Data = data
+	msg.Header.Set("X-Account-ID", testAccountID)
+	return nc.RequestMsg(msg, timeout)
+}
+
 // createFullTestDaemonWithStore creates a test daemon with ALL services initialized
 // and returns the shared memory store for seeding test data.
 func createFullTestDaemonWithStore(t *testing.T, natsURL string) (*Daemon, *objectstore.MemoryObjectStore) {
@@ -42,8 +53,8 @@ func createFullTestDaemonWithStore(t *testing.T, natsURL string) (*Daemon, *obje
 	memStore := objectstore.NewMemoryObjectStore()
 	cfg := daemon.config
 
-	daemon.keyService = handlers_ec2_key.NewKeyServiceImplWithStore(memStore, cfg.Predastore.Bucket, "123456789")
-	daemon.imageService = handlers_ec2_image.NewImageServiceImplWithStore(memStore, cfg.Predastore.Bucket, "123456789")
+	daemon.keyService = handlers_ec2_key.NewKeyServiceImplWithStore(memStore, cfg.Predastore.Bucket)
+	daemon.imageService = handlers_ec2_image.NewImageServiceImplWithStore(memStore, cfg.Predastore.Bucket)
 	daemon.volumeService = handlers_ec2_volume.NewVolumeServiceImplWithStore(cfg, memStore, daemon.natsConn)
 	daemon.snapshotService = handlers_ec2_snapshot.NewSnapshotServiceImplWithStore(cfg, memStore, daemon.natsConn)
 	daemon.tagsService = handlers_ec2_tags.NewTagsServiceImplWithStore(cfg, memStore)
@@ -117,7 +128,7 @@ func TestHandleNATSRequest_ValidRequest(t *testing.T) {
 	require.NoError(t, err)
 	defer nc.Close()
 
-	serviceFn := func(in *testInput) (*testOutput, error) {
+	serviceFn := func(in *testInput, accountID string) (*testOutput, error) {
 		return &testOutput{Greeting: "hello " + in.Name}, nil
 	}
 
@@ -144,7 +155,7 @@ func TestHandleNATSRequest_MalformedJSON(t *testing.T) {
 	require.NoError(t, err)
 	defer nc.Close()
 
-	serviceFn := func(in *testInput) (*testOutput, error) {
+	serviceFn := func(in *testInput, accountID string) (*testOutput, error) {
 		return &testOutput{Greeting: "hello"}, nil
 	}
 
@@ -170,7 +181,7 @@ func TestHandleNATSRequest_ServiceError(t *testing.T) {
 	require.NoError(t, err)
 	defer nc.Close()
 
-	serviceFn := func(in *testInput) (*testOutput, error) {
+	serviceFn := func(in *testInput, accountID string) (*testOutput, error) {
 		return nil, fmt.Errorf("something went wrong")
 	}
 
@@ -205,7 +216,7 @@ func TestHandleEC2CreateKeyPair_RoundTrip(t *testing.T) {
 		KeyName: aws.String("test-key-001"),
 	}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.CreateKeyPair", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.CreateKeyPair", reqData, 5*time.Second)
 	require.NoError(t, err)
 	require.NotNil(t, reply)
 
@@ -293,7 +304,7 @@ func TestHandleEC2DescribeKeyPairs_RoundTrip(t *testing.T) {
 
 	input := &ec2.DescribeKeyPairsInput{}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.DescribeKeyPairs", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.DescribeKeyPairs", reqData, 5*time.Second)
 	require.NoError(t, err)
 	require.NotNil(t, reply)
 
@@ -378,7 +389,7 @@ func TestHandleEC2RunInstances_InvalidAMI(t *testing.T) {
 		MaxCount:     aws.Int64(1),
 	}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.RunInstances", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.RunInstances", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	// Should return InvalidAMIID.NotFound, not ServerInternal
@@ -405,7 +416,7 @@ func TestHandleEC2RunInstances_InvalidKeyPair(t *testing.T) {
 		MaxCount:     aws.Int64(1),
 	}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.RunInstances", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.RunInstances", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	// Should return InvalidKeyPair.NotFound, not proceed to launch
@@ -424,7 +435,7 @@ func TestHandleEC2RunInstances_ValidKeyPairPassesValidation(t *testing.T) {
 	bucket := daemon.config.Predastore.Bucket
 	_, err := memStore.PutObject(&awss3.PutObjectInput{
 		Bucket: aws.String(bucket),
-		Key:    aws.String("keys/123456789/my-key"),
+		Key:    aws.String("keys/" + testAccountID + "/my-key"),
 		Body:   strings.NewReader("ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITest"),
 	})
 	require.NoError(t, err)
@@ -432,7 +443,7 @@ func TestHandleEC2RunInstances_ValidKeyPairPassesValidation(t *testing.T) {
 	metadataJSON := `{"KeyPairId":"key-abc123","KeyName":"my-key","KeyFingerprint":"SHA256:test"}`
 	_, err = memStore.PutObject(&awss3.PutObjectInput{
 		Bucket: aws.String(bucket),
-		Key:    aws.String("keys/123456789/key-abc123.json"),
+		Key:    aws.String("keys/" + testAccountID + "/key-abc123.json"),
 		Body:   strings.NewReader(metadataJSON),
 	})
 	require.NoError(t, err)
@@ -449,7 +460,7 @@ func TestHandleEC2RunInstances_ValidKeyPairPassesValidation(t *testing.T) {
 		MaxCount:     aws.Int64(1),
 	}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.RunInstances", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.RunInstances", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	// Should NOT contain InvalidKeyPair.NotFound — key pair validation should pass
@@ -474,7 +485,7 @@ func TestHandleEC2RunInstances_EmptyKeyNameSkipsValidation(t *testing.T) {
 		MaxCount:     aws.Int64(1),
 	}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.RunInstances", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.RunInstances", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	// Should NOT contain InvalidKeyPair.NotFound
@@ -509,7 +520,7 @@ func TestHandleEC2RunInstances_ServiceErrorPropagated(t *testing.T) {
 		MaxCount:     aws.Int64(1),
 	}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.RunInstances", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.RunInstances", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	// Should propagate the specific AWS error from the service layer,
@@ -735,7 +746,7 @@ func TestHandleEC2GetEbsEncryptionByDefault(t *testing.T) {
 
 	input := &ec2.GetEbsEncryptionByDefaultInput{}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.GetEbsEncryptionByDefault", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.GetEbsEncryptionByDefault", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var output ec2.GetEbsEncryptionByDefaultOutput
@@ -755,7 +766,7 @@ func TestHandleEC2GetSerialConsoleAccessStatus(t *testing.T) {
 
 	input := &ec2.GetSerialConsoleAccessStatusInput{}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.GetSerialConsoleAccessStatus", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.GetSerialConsoleAccessStatus", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var output ec2.GetSerialConsoleAccessStatusOutput
@@ -775,7 +786,7 @@ func TestHandleEC2EnableEbsEncryptionByDefault(t *testing.T) {
 
 	input := &ec2.EnableEbsEncryptionByDefaultInput{}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.EnableEbsEncryptionByDefault", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.EnableEbsEncryptionByDefault", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var output ec2.EnableEbsEncryptionByDefaultOutput
@@ -796,7 +807,7 @@ func TestHandleEC2DisableEbsEncryptionByDefault(t *testing.T) {
 
 	input := &ec2.DisableEbsEncryptionByDefaultInput{}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.DisableEbsEncryptionByDefault", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.DisableEbsEncryptionByDefault", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var output ec2.DisableEbsEncryptionByDefaultOutput
@@ -817,7 +828,7 @@ func TestHandleEC2EnableSerialConsoleAccess(t *testing.T) {
 
 	input := &ec2.EnableSerialConsoleAccessInput{}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.EnableSerialConsoleAccess", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.EnableSerialConsoleAccess", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var output ec2.EnableSerialConsoleAccessOutput
@@ -838,7 +849,7 @@ func TestHandleEC2DisableSerialConsoleAccess(t *testing.T) {
 
 	input := &ec2.DisableSerialConsoleAccessInput{}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.DisableSerialConsoleAccess", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.DisableSerialConsoleAccess", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var output ec2.DisableSerialConsoleAccessOutput
@@ -1853,7 +1864,7 @@ func TestDelegateHandlers_RoundTrip(t *testing.T) {
 			reqData, err := json.Marshal(tt.input)
 			require.NoError(t, err)
 
-			reply, err := daemon.natsConn.Request(tt.topic, reqData, 5*time.Second)
+			reply, err := natsRequest(daemon.natsConn, tt.topic, reqData, 5*time.Second)
 			require.NoError(t, err)
 			require.NotNil(t, reply)
 
@@ -2167,7 +2178,7 @@ func TestDelegateHandlers_VPC(t *testing.T) {
 			reqData, err := json.Marshal(tt.input)
 			require.NoError(t, err)
 
-			reply, err := daemon.natsConn.Request(tt.topic, reqData, 5*time.Second)
+			reply, err := natsRequest(daemon.natsConn, tt.topic, reqData, 5*time.Second)
 			require.NoError(t, err)
 			require.NotNil(t, reply)
 
@@ -2234,7 +2245,7 @@ func TestDelegateHandlers_IGW(t *testing.T) {
 			reqData, err := json.Marshal(tt.input)
 			require.NoError(t, err)
 
-			reply, err := daemon.natsConn.Request(tt.topic, reqData, 5*time.Second)
+			reply, err := natsRequest(daemon.natsConn, tt.topic, reqData, 5*time.Second)
 			require.NoError(t, err)
 			require.NotNil(t, reply)
 
@@ -2254,7 +2265,7 @@ func TestHandleEC2CreateVpc_SuccessPath(t *testing.T) {
 
 	input := &ec2.CreateVpcInput{CidrBlock: aws.String("10.100.0.0/16")}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.CreateVpc", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.CreateVpc", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var output ec2.CreateVpcOutput
@@ -2280,7 +2291,7 @@ func TestHandleEC2CreateAndDescribeVpc_RoundTrip(t *testing.T) {
 	// Create a VPC
 	createInput := &ec2.CreateVpcInput{CidrBlock: aws.String("10.200.0.0/16")}
 	reqData, _ := json.Marshal(createInput)
-	reply, err := daemon.natsConn.Request("ec2.CreateVpc", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.CreateVpc", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var createOutput ec2.CreateVpcOutput
@@ -2290,7 +2301,7 @@ func TestHandleEC2CreateAndDescribeVpc_RoundTrip(t *testing.T) {
 	// Describe VPCs and verify the created VPC appears
 	describeInput := &ec2.DescribeVpcsInput{}
 	reqData, _ = json.Marshal(describeInput)
-	reply, err = daemon.natsConn.Request("ec2.DescribeVpcs", reqData, 5*time.Second)
+	reply, err = natsRequest(daemon.natsConn, "ec2.DescribeVpcs", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var describeOutput ec2.DescribeVpcsOutput
@@ -2315,7 +2326,7 @@ func TestHandleEC2CreateInternetGateway_SuccessPath(t *testing.T) {
 
 	input := &ec2.CreateInternetGatewayInput{}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.CreateInternetGateway", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.CreateInternetGateway", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var output ec2.CreateInternetGatewayOutput
@@ -2340,7 +2351,7 @@ func TestHandleEC2CreateSubnet_SuccessPath(t *testing.T) {
 	// Create a VPC first
 	vpcInput := &ec2.CreateVpcInput{CidrBlock: aws.String("10.50.0.0/16")}
 	reqData, _ := json.Marshal(vpcInput)
-	reply, err := daemon.natsConn.Request("ec2.CreateVpc", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.CreateVpc", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var vpcOutput ec2.CreateVpcOutput
@@ -2353,7 +2364,7 @@ func TestHandleEC2CreateSubnet_SuccessPath(t *testing.T) {
 		CidrBlock: aws.String("10.50.1.0/24"),
 	}
 	reqData, _ = json.Marshal(subnetInput)
-	reply, err = daemon.natsConn.Request("ec2.CreateSubnet", reqData, 5*time.Second)
+	reply, err = natsRequest(daemon.natsConn, "ec2.CreateSubnet", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var subnetOutput ec2.CreateSubnetOutput
@@ -2426,7 +2437,7 @@ func TestDelegateHandlers_EIGW(t *testing.T) {
 			reqData, err := json.Marshal(tt.input)
 			require.NoError(t, err)
 
-			reply, err := daemon.natsConn.Request(tt.topic, reqData, 5*time.Second)
+			reply, err := natsRequest(daemon.natsConn, tt.topic, reqData, 5*time.Second)
 			require.NoError(t, err)
 			require.NotNil(t, reply)
 
@@ -3106,7 +3117,7 @@ func TestHandleEC2RunInstances_InsufficientCapacity(t *testing.T) {
 		MaxCount:     aws.Int64(9999),
 	}
 	reqData, _ := json.Marshal(input)
-	reply, err := daemon.natsConn.Request("ec2.RunInstances", reqData, 5*time.Second)
+	reply, err := natsRequest(daemon.natsConn, "ec2.RunInstances", reqData, 5*time.Second)
 	require.NoError(t, err)
 
 	var errResp map[string]any
diff --git a/hive/daemon/daemon_handlers_volume.go b/hive/daemon/daemon_handlers_volume.go
index 66100e144..b8539ecd8 100644
--- a/hive/daemon/daemon_handlers_volume.go
+++ b/hive/daemon/daemon_handlers_volume.go
@@ -52,6 +52,14 @@ func (d *Daemon) handleAttachVolume(msg *nats.Msg, command qmp.Command, instance
 		return
 	}
 
+	// Account scoping: verify the caller owns this volume
+	callerAccountID := utils.AccountIDFromMsg(msg)
+	if callerAccountID != "" && volCfg.VolumeMetadata.TenantID != "" && volCfg.VolumeMetadata.TenantID != callerAccountID {
+		slog.Warn("AttachVolume: account does not own volume", "volumeId", volumeID, "callerAccount", callerAccountID, "ownerAccount", volCfg.VolumeMetadata.TenantID)
+		respondWithError(msg, awserrors.ErrorInvalidVolumeNotFound)
+		return
+	}
+
 	if volCfg.VolumeMetadata.State != "available" {
 		slog.Error("AttachVolume: volume not available", "volumeId", volumeID, "state", volCfg.VolumeMetadata.State)
 		respondWithError(msg, awserrors.ErrorVolumeInUse)
@@ -446,6 +454,8 @@ func (d *Daemon) handleEC2ModifyVolume(msg *nats.Msg) {
 	slog.Debug("Received message", "subject", msg.Subject)
 	slog.Debug("Message data", "data", string(msg.Data))
 
+	accountID := utils.AccountIDFromMsg(msg)
+
 	modifyVolumeInput := &ec2.ModifyVolumeInput{}
 	errResp := utils.UnmarshalJsonPayload(modifyVolumeInput, msg.Data)
 
@@ -457,9 +467,9 @@ func (d *Daemon) handleEC2ModifyVolume(msg *nats.Msg) {
 		return
 	}
 
-	slog.Info("Processing ModifyVolume request", "volumeId", modifyVolumeInput.VolumeId)
+	slog.Info("Processing ModifyVolume request", "volumeId", modifyVolumeInput.VolumeId, "accountID", accountID)
 
-	output, err := d.volumeService.ModifyVolume(modifyVolumeInput)
+	output, err := d.volumeService.ModifyVolume(modifyVolumeInput, accountID)
 
 	if err != nil {
 		slog.Error("handleEC2ModifyVolume service.ModifyVolume failed", "err", err)
diff --git a/hive/daemon/daemon_test.go b/hive/daemon/daemon_test.go
index df5fd5564..4c6f0f390 100644
--- a/hive/daemon/daemon_test.go
+++ b/hive/daemon/daemon_test.go
@@ -1316,7 +1316,7 @@ func TestRunInstances_CountValidation(t *testing.T) {
 		}
 		inputJSON, _ := json.Marshal(input)
 
-		resp, err := daemon.natsConn.Request(topic, inputJSON, 5*time.Second)
+		resp, err := natsRequest(daemon.natsConn, topic, inputJSON, 5*time.Second)
 		require.NoError(t, err)
 
 		// Should return validation error
@@ -1336,7 +1336,7 @@ func TestRunInstances_CountValidation(t *testing.T) {
 		}
 		inputJSON, _ := json.Marshal(input)
 
-		resp, err := daemon.natsConn.Request(topic, inputJSON, 5*time.Second)
+		resp, err := natsRequest(daemon.natsConn, topic, inputJSON, 5*time.Second)
 		require.NoError(t, err)
 
 		var errResp map[string]any
@@ -1355,7 +1355,7 @@ func TestRunInstances_CountValidation(t *testing.T) {
 		}
 		inputJSON, _ := json.Marshal(input)
 
-		resp, err := daemon.natsConn.Request(topic, inputJSON, 5*time.Second)
+		resp, err := natsRequest(daemon.natsConn, topic, inputJSON, 5*time.Second)
 		require.NoError(t, err)
 
 		var errResp map[string]any
diff --git a/hive/gateway/ec2.go b/hive/gateway/ec2.go
index 01cb45f64..166d4c235 100644
--- a/hive/gateway/ec2.go
+++ b/hive/gateway/ec2.go
@@ -4,6 +4,7 @@ package gateway
 
 import (
 	"errors"
+	"log/slog"
 	"strings"
 
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -26,17 +27,18 @@ import (
 
 // EC2Handler processes parsed query args and returns XML response bytes.
 // The action parameter is the EC2 API action name, passed from the map key.
-type EC2Handler func(action string, q map[string]string, gw *GatewayConfig) ([]byte, error)
+// accountID is the caller's AWS account ID extracted from SigV4 auth context.
+type EC2Handler func(action string, q map[string]string, gw *GatewayConfig, accountID string) ([]byte, error)
 
 // ec2Handler creates a type-safe EC2Handler that allocates the typed input struct,
 // parses query params into it, calls the handler, and marshals the output to XML.
-func ec2Handler[In any](handler func(*In, *GatewayConfig) (any, error)) EC2Handler {
-	return func(action string, q map[string]string, gw *GatewayConfig) ([]byte, error) {
+func ec2Handler[In any](handler func(*In, *GatewayConfig, string) (any, error)) EC2Handler {
+	return func(action string, q map[string]string, gw *GatewayConfig, accountID string) ([]byte, error) {
 		input := new(In)
 		if err := awsec2query.QueryParamsToStruct(q, input); err != nil {
 			return nil, err
 		}
-		output, err := handler(input, gw)
+		output, err := handler(input, gw, accountID)
 		if err != nil {
 			return nil, err
 		}
@@ -50,173 +52,173 @@ func ec2Handler[In any](handler func(*In, *GatewayConfig) (any, error)) EC2Handl
 }
 
 var ec2Actions = map[string]EC2Handler{
-	"DescribeInstances": ec2Handler(func(input *ec2.DescribeInstancesInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_instance.DescribeInstances(input, gw.NATSConn, gw.DiscoverActiveNodes())
+	"DescribeInstances": ec2Handler(func(input *ec2.DescribeInstancesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_instance.DescribeInstances(input, gw.NATSConn, gw.DiscoverActiveNodes(), accountID)
 	}),
-	"RunInstances": ec2Handler(func(input *ec2.RunInstancesInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_instance.RunInstances(input, gw.NATSConn)
+	"RunInstances": ec2Handler(func(input *ec2.RunInstancesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_instance.RunInstances(input, gw.NATSConn, accountID)
 	}),
-	"StartInstances": ec2Handler(func(input *ec2.StartInstancesInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_instance.StartInstances(input, gw.NATSConn)
+	"StartInstances": ec2Handler(func(input *ec2.StartInstancesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_instance.StartInstances(input, gw.NATSConn, accountID)
 	}),
-	"StopInstances": ec2Handler(func(input *ec2.StopInstancesInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_instance.StopInstances(input, gw.NATSConn)
+	"StopInstances": ec2Handler(func(input *ec2.StopInstancesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_instance.StopInstances(input, gw.NATSConn, accountID)
 	}),
-	"TerminateInstances": ec2Handler(func(input *ec2.TerminateInstancesInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_instance.TerminateInstances(input, gw.NATSConn)
+	"TerminateInstances": ec2Handler(func(input *ec2.TerminateInstancesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_instance.TerminateInstances(input, gw.NATSConn, accountID)
 	}),
-	"DescribeInstanceTypes": ec2Handler(func(input *ec2.DescribeInstanceTypesInput, gw *GatewayConfig) (any, error) {
+	"DescribeInstanceTypes": ec2Handler(func(input *ec2.DescribeInstanceTypesInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_ec2_instance.DescribeInstanceTypes(input, gw.NATSConn, gw.ExpectedNodes)
 	}),
-	"GetConsoleOutput": ec2Handler(func(input *ec2.GetConsoleOutputInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_instance.GetConsoleOutput(input, gw.NATSConn)
+	"GetConsoleOutput": ec2Handler(func(input *ec2.GetConsoleOutputInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_instance.GetConsoleOutput(input, gw.NATSConn, accountID)
 	}),
-	"ModifyInstanceAttribute": ec2Handler(func(input *ec2.ModifyInstanceAttributeInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_instance.ModifyInstanceAttribute(input, gw.NATSConn)
+	"ModifyInstanceAttribute": ec2Handler(func(input *ec2.ModifyInstanceAttributeInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_instance.ModifyInstanceAttribute(input, gw.NATSConn, accountID)
 	}),
-	"CreateKeyPair": ec2Handler(func(input *ec2.CreateKeyPairInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_key.CreateKeyPair(input, gw.NATSConn)
+	"CreateKeyPair": ec2Handler(func(input *ec2.CreateKeyPairInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_key.CreateKeyPair(input, gw.NATSConn, accountID)
 	}),
-	"DeleteKeyPair": ec2Handler(func(input *ec2.DeleteKeyPairInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_key.DeleteKeyPair(input, gw.NATSConn)
+	"DeleteKeyPair": ec2Handler(func(input *ec2.DeleteKeyPairInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_key.DeleteKeyPair(input, gw.NATSConn, accountID)
 	}),
-	"DescribeKeyPairs": ec2Handler(func(input *ec2.DescribeKeyPairsInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_key.DescribeKeyPairs(input, gw.NATSConn)
+	"DescribeKeyPairs": ec2Handler(func(input *ec2.DescribeKeyPairsInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_key.DescribeKeyPairs(input, gw.NATSConn, accountID)
 	}),
-	"ImportKeyPair": func(action string, q map[string]string, gw *GatewayConfig) ([]byte, error) {
+	"ImportKeyPair": func(action string, q map[string]string, gw *GatewayConfig, accountID string) ([]byte, error) {
 		// Workaround: parser leaves Base64 padding URL-encoded
 		if strings.HasSuffix(q["PublicKeyMaterial"], "%3D%3D") {
 			q["PublicKeyMaterial"] = strings.Replace(q["PublicKeyMaterial"], "%3D%3D", "==", 1)
 		}
-		return ec2Handler(func(input *ec2.ImportKeyPairInput, gw *GatewayConfig) (any, error) {
-			return gateway_ec2_key.ImportKeyPair(input, gw.NATSConn)
-		})(action, q, gw)
+		return ec2Handler(func(input *ec2.ImportKeyPairInput, gw *GatewayConfig, accountID string) (any, error) {
+			return gateway_ec2_key.ImportKeyPair(input, gw.NATSConn, accountID)
+		})(action, q, gw, accountID)
 	},
-	"DescribeImages": ec2Handler(func(input *ec2.DescribeImagesInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_image.DescribeImages(input, gw.NATSConn)
+	"DescribeImages": ec2Handler(func(input *ec2.DescribeImagesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_image.DescribeImages(input, gw.NATSConn, accountID)
 	}),
-	"CreateImage": ec2Handler(func(input *ec2.CreateImageInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_image.CreateImage(input, gw.NATSConn)
+	"CreateImage": ec2Handler(func(input *ec2.CreateImageInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_image.CreateImage(input, gw.NATSConn, accountID)
 	}),
-	"DescribeRegions": ec2Handler(func(input *ec2.DescribeRegionsInput, gw *GatewayConfig) (any, error) {
+	"DescribeRegions": ec2Handler(func(input *ec2.DescribeRegionsInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_ec2_zone.DescribeRegions(input, gw.Region)
 	}),
-	"DescribeAvailabilityZones": ec2Handler(func(input *ec2.DescribeAvailabilityZonesInput, gw *GatewayConfig) (any, error) {
+	"DescribeAvailabilityZones": ec2Handler(func(input *ec2.DescribeAvailabilityZonesInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_ec2_zone.DescribeAvailabilityZones(input, gw.Region, gw.AZ)
 	}),
-	"DescribeVolumes": ec2Handler(func(input *ec2.DescribeVolumesInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_volume.DescribeVolumes(input, gw.NATSConn)
+	"DescribeVolumes": ec2Handler(func(input *ec2.DescribeVolumesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_volume.DescribeVolumes(input, gw.NATSConn, accountID)
 	}),
-	"ModifyVolume": ec2Handler(func(input *ec2.ModifyVolumeInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_volume.ModifyVolume(input, gw.NATSConn)
+	"ModifyVolume": ec2Handler(func(input *ec2.ModifyVolumeInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_volume.ModifyVolume(input, gw.NATSConn, accountID)
 	}),
-	"CreateVolume": ec2Handler(func(input *ec2.CreateVolumeInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_volume.CreateVolume(input, gw.NATSConn)
+	"CreateVolume": ec2Handler(func(input *ec2.CreateVolumeInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_volume.CreateVolume(input, gw.NATSConn, accountID)
 	}),
-	"DeleteVolume": ec2Handler(func(input *ec2.DeleteVolumeInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_volume.DeleteVolume(input, gw.NATSConn)
+	"DeleteVolume": ec2Handler(func(input *ec2.DeleteVolumeInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_volume.DeleteVolume(input, gw.NATSConn, accountID)
 	}),
-	"AttachVolume": ec2Handler(func(input *ec2.AttachVolumeInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_volume.AttachVolume(input, gw.NATSConn)
+	"AttachVolume": ec2Handler(func(input *ec2.AttachVolumeInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_volume.AttachVolume(input, gw.NATSConn, accountID)
 	}),
-	"DescribeVolumeStatus": ec2Handler(func(input *ec2.DescribeVolumeStatusInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_volume.DescribeVolumeStatus(input, gw.NATSConn)
+	"DescribeVolumeStatus": ec2Handler(func(input *ec2.DescribeVolumeStatusInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_volume.DescribeVolumeStatus(input, gw.NATSConn, accountID)
 	}),
-	"DetachVolume": ec2Handler(func(input *ec2.DetachVolumeInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_volume.DetachVolume(input, gw.NATSConn)
+	"DetachVolume": ec2Handler(func(input *ec2.DetachVolumeInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_volume.DetachVolume(input, gw.NATSConn, accountID)
 	}),
-	"DescribeAccountAttributes": ec2Handler(func(input *ec2.DescribeAccountAttributesInput, gw *GatewayConfig) (any, error) {
+	"DescribeAccountAttributes": ec2Handler(func(input *ec2.DescribeAccountAttributesInput, gw *GatewayConfig, accountID string) (any, error) {
 		return gateway_ec2_account.DescribeAccountAttributes(input)
 	}),
-	"EnableEbsEncryptionByDefault": ec2Handler(func(input *ec2.EnableEbsEncryptionByDefaultInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_account.EnableEbsEncryptionByDefault(input, gw.NATSConn)
+	"EnableEbsEncryptionByDefault": ec2Handler(func(input *ec2.EnableEbsEncryptionByDefaultInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_account.EnableEbsEncryptionByDefault(input, gw.NATSConn, accountID)
 	}),
-	"DisableEbsEncryptionByDefault": ec2Handler(func(input *ec2.DisableEbsEncryptionByDefaultInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_account.DisableEbsEncryptionByDefault(input, gw.NATSConn)
+	"DisableEbsEncryptionByDefault": ec2Handler(func(input *ec2.DisableEbsEncryptionByDefaultInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_account.DisableEbsEncryptionByDefault(input, gw.NATSConn, accountID)
 	}),
-	"GetEbsEncryptionByDefault": ec2Handler(func(input *ec2.GetEbsEncryptionByDefaultInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_account.GetEbsEncryptionByDefault(input, gw.NATSConn)
+	"GetEbsEncryptionByDefault": ec2Handler(func(input *ec2.GetEbsEncryptionByDefaultInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_account.GetEbsEncryptionByDefault(input, gw.NATSConn, accountID)
 	}),
-	"GetSerialConsoleAccessStatus": ec2Handler(func(input *ec2.GetSerialConsoleAccessStatusInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_account.GetSerialConsoleAccessStatus(input, gw.NATSConn)
+	"GetSerialConsoleAccessStatus": ec2Handler(func(input *ec2.GetSerialConsoleAccessStatusInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_account.GetSerialConsoleAccessStatus(input, gw.NATSConn, accountID)
 	}),
-	"EnableSerialConsoleAccess": ec2Handler(func(input *ec2.EnableSerialConsoleAccessInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_account.EnableSerialConsoleAccess(input, gw.NATSConn)
+	"EnableSerialConsoleAccess": ec2Handler(func(input *ec2.EnableSerialConsoleAccessInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_account.EnableSerialConsoleAccess(input, gw.NATSConn, accountID)
 	}),
-	"DisableSerialConsoleAccess": ec2Handler(func(input *ec2.DisableSerialConsoleAccessInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_account.DisableSerialConsoleAccess(input, gw.NATSConn)
+	"DisableSerialConsoleAccess": ec2Handler(func(input *ec2.DisableSerialConsoleAccessInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_account.DisableSerialConsoleAccess(input, gw.NATSConn, accountID)
 	}),
-	"CreateTags": ec2Handler(func(input *ec2.CreateTagsInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_tags.CreateTags(input, gw.NATSConn)
+	"CreateTags": ec2Handler(func(input *ec2.CreateTagsInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_tags.CreateTags(input, gw.NATSConn, accountID)
 	}),
-	"DeleteTags": ec2Handler(func(input *ec2.DeleteTagsInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_tags.DeleteTags(input, gw.NATSConn)
+	"DeleteTags": ec2Handler(func(input *ec2.DeleteTagsInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_tags.DeleteTags(input, gw.NATSConn, accountID)
 	}),
-	"DescribeTags": ec2Handler(func(input *ec2.DescribeTagsInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_tags.DescribeTags(input, gw.NATSConn)
+	"DescribeTags": ec2Handler(func(input *ec2.DescribeTagsInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_tags.DescribeTags(input, gw.NATSConn, accountID)
 	}),
-	"CreateSnapshot": ec2Handler(func(input *ec2.CreateSnapshotInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_snapshot.CreateSnapshot(input, gw.NATSConn)
+	"CreateSnapshot": ec2Handler(func(input *ec2.CreateSnapshotInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_snapshot.CreateSnapshot(input, gw.NATSConn, accountID)
 	}),
-	"DeleteSnapshot": ec2Handler(func(input *ec2.DeleteSnapshotInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_snapshot.DeleteSnapshot(input, gw.NATSConn)
+	"DeleteSnapshot": ec2Handler(func(input *ec2.DeleteSnapshotInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_snapshot.DeleteSnapshot(input, gw.NATSConn, accountID)
 	}),
-	"DescribeSnapshots": ec2Handler(func(input *ec2.DescribeSnapshotsInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_snapshot.DescribeSnapshots(input, gw.NATSConn)
+	"DescribeSnapshots": ec2Handler(func(input *ec2.DescribeSnapshotsInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_snapshot.DescribeSnapshots(input, gw.NATSConn, accountID)
 	}),
-	"CopySnapshot": ec2Handler(func(input *ec2.CopySnapshotInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_snapshot.CopySnapshot(input, gw.NATSConn)
+	"CopySnapshot": ec2Handler(func(input *ec2.CopySnapshotInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_snapshot.CopySnapshot(input, gw.NATSConn, accountID)
 	}),
-	"CreateInternetGateway": ec2Handler(func(input *ec2.CreateInternetGatewayInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_igw.CreateInternetGateway(input, gw.NATSConn)
+	"CreateInternetGateway": ec2Handler(func(input *ec2.CreateInternetGatewayInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_igw.CreateInternetGateway(input, gw.NATSConn, accountID)
 	}),
-	"DeleteInternetGateway": ec2Handler(func(input *ec2.DeleteInternetGatewayInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_igw.DeleteInternetGateway(input, gw.NATSConn)
+	"DeleteInternetGateway": ec2Handler(func(input *ec2.DeleteInternetGatewayInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_igw.DeleteInternetGateway(input, gw.NATSConn, accountID)
 	}),
-	"DescribeInternetGateways": ec2Handler(func(input *ec2.DescribeInternetGatewaysInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_igw.DescribeInternetGateways(input, gw.NATSConn)
+	"DescribeInternetGateways": ec2Handler(func(input *ec2.DescribeInternetGatewaysInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_igw.DescribeInternetGateways(input, gw.NATSConn, accountID)
 	}),
-	"AttachInternetGateway": ec2Handler(func(input *ec2.AttachInternetGatewayInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_igw.AttachInternetGateway(input, gw.NATSConn)
+	"AttachInternetGateway": ec2Handler(func(input *ec2.AttachInternetGatewayInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_igw.AttachInternetGateway(input, gw.NATSConn, accountID)
 	}),
-	"DetachInternetGateway": ec2Handler(func(input *ec2.DetachInternetGatewayInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_igw.DetachInternetGateway(input, gw.NATSConn)
+	"DetachInternetGateway": ec2Handler(func(input *ec2.DetachInternetGatewayInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_igw.DetachInternetGateway(input, gw.NATSConn, accountID)
 	}),
-	"CreateEgressOnlyInternetGateway": ec2Handler(func(input *ec2.CreateEgressOnlyInternetGatewayInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_eigw.CreateEgressOnlyInternetGateway(input, gw.NATSConn)
+	"CreateEgressOnlyInternetGateway": ec2Handler(func(input *ec2.CreateEgressOnlyInternetGatewayInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_eigw.CreateEgressOnlyInternetGateway(input, gw.NATSConn, accountID)
 	}),
-	"DeleteEgressOnlyInternetGateway": ec2Handler(func(input *ec2.DeleteEgressOnlyInternetGatewayInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_eigw.DeleteEgressOnlyInternetGateway(input, gw.NATSConn)
+	"DeleteEgressOnlyInternetGateway": ec2Handler(func(input *ec2.DeleteEgressOnlyInternetGatewayInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_eigw.DeleteEgressOnlyInternetGateway(input, gw.NATSConn, accountID)
 	}),
-	"DescribeEgressOnlyInternetGateways": ec2Handler(func(input *ec2.DescribeEgressOnlyInternetGatewaysInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_eigw.DescribeEgressOnlyInternetGateways(input, gw.NATSConn)
+	"DescribeEgressOnlyInternetGateways": ec2Handler(func(input *ec2.DescribeEgressOnlyInternetGatewaysInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_eigw.DescribeEgressOnlyInternetGateways(input, gw.NATSConn, accountID)
 	}),
-	"CreateVpc": ec2Handler(func(input *ec2.CreateVpcInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_vpc.CreateVpc(input, gw.NATSConn)
+	"CreateVpc": ec2Handler(func(input *ec2.CreateVpcInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_vpc.CreateVpc(input, gw.NATSConn, accountID)
 	}),
-	"DeleteVpc": ec2Handler(func(input *ec2.DeleteVpcInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_vpc.DeleteVpc(input, gw.NATSConn)
+	"DeleteVpc": ec2Handler(func(input *ec2.DeleteVpcInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_vpc.DeleteVpc(input, gw.NATSConn, accountID)
 	}),
-	"DescribeVpcs": ec2Handler(func(input *ec2.DescribeVpcsInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_vpc.DescribeVpcs(input, gw.NATSConn)
+	"DescribeVpcs": ec2Handler(func(input *ec2.DescribeVpcsInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_vpc.DescribeVpcs(input, gw.NATSConn, accountID)
 	}),
-	"CreateSubnet": ec2Handler(func(input *ec2.CreateSubnetInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_vpc.CreateSubnet(input, gw.NATSConn)
+	"CreateSubnet": ec2Handler(func(input *ec2.CreateSubnetInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_vpc.CreateSubnet(input, gw.NATSConn, accountID)
 	}),
-	"DeleteSubnet": ec2Handler(func(input *ec2.DeleteSubnetInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_vpc.DeleteSubnet(input, gw.NATSConn)
+	"DeleteSubnet": ec2Handler(func(input *ec2.DeleteSubnetInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_vpc.DeleteSubnet(input, gw.NATSConn, accountID)
 	}),
-	"DescribeSubnets": ec2Handler(func(input *ec2.DescribeSubnetsInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_vpc.DescribeSubnets(input, gw.NATSConn)
+	"DescribeSubnets": ec2Handler(func(input *ec2.DescribeSubnetsInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_vpc.DescribeSubnets(input, gw.NATSConn, accountID)
 	}),
-	"CreateNetworkInterface": ec2Handler(func(input *ec2.CreateNetworkInterfaceInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_vpc.CreateNetworkInterface(input, gw.NATSConn)
+	"CreateNetworkInterface": ec2Handler(func(input *ec2.CreateNetworkInterfaceInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_vpc.CreateNetworkInterface(input, gw.NATSConn, accountID)
 	}),
-	"DeleteNetworkInterface": ec2Handler(func(input *ec2.DeleteNetworkInterfaceInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_vpc.DeleteNetworkInterface(input, gw.NATSConn)
+	"DeleteNetworkInterface": ec2Handler(func(input *ec2.DeleteNetworkInterfaceInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_vpc.DeleteNetworkInterface(input, gw.NATSConn, accountID)
 	}),
-	"DescribeNetworkInterfaces": ec2Handler(func(input *ec2.DescribeNetworkInterfacesInput, gw *GatewayConfig) (any, error) {
-		return gateway_ec2_vpc.DescribeNetworkInterfaces(input, gw.NATSConn)
+	"DescribeNetworkInterfaces": ec2Handler(func(input *ec2.DescribeNetworkInterfacesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return gateway_ec2_vpc.DescribeNetworkInterfaces(input, gw.NATSConn, accountID)
 	}),
 }
 
@@ -244,7 +246,14 @@ func (gw *GatewayConfig) EC2_Request(ctx *fiber.Ctx) error {
 		return errors.New(awserrors.ErrorServerInternal)
 	}
 
-	xmlOutput, err := handler(action, queryArgs, gw)
+	// Extract account ID from auth context
+	accountID, _ := ctx.Locals("sigv4.accountId").(string)
+	if accountID == "" {
+		slog.Error("EC2_Request: no account ID in auth context")
+		return errors.New(awserrors.ErrorServerInternal)
+	}
+
+	xmlOutput, err := handler(action, queryArgs, gw, accountID)
 	if err != nil {
 		return err
 	}
diff --git a/hive/gateway/ec2/account/DisableEbsEncryptionByDefault.go b/hive/gateway/ec2/account/DisableEbsEncryptionByDefault.go
index b56eba392..760377a65 100644
--- a/hive/gateway/ec2/account/DisableEbsEncryptionByDefault.go
+++ b/hive/gateway/ec2/account/DisableEbsEncryptionByDefault.go
@@ -16,7 +16,7 @@ func ValidateDisableEbsEncryptionByDefaultInput(input *ec2.DisableEbsEncryptionB
 	return nil
 }
 
-func DisableEbsEncryptionByDefault(input *ec2.DisableEbsEncryptionByDefaultInput, natsConn *nats.Conn) (ec2.DisableEbsEncryptionByDefaultOutput, error) {
+func DisableEbsEncryptionByDefault(input *ec2.DisableEbsEncryptionByDefaultInput, natsConn *nats.Conn, accountID string) (ec2.DisableEbsEncryptionByDefaultOutput, error) {
 	var output ec2.DisableEbsEncryptionByDefaultOutput
 
 	if err := ValidateDisableEbsEncryptionByDefaultInput(input); err != nil {
@@ -24,7 +24,7 @@ func DisableEbsEncryptionByDefault(input *ec2.DisableEbsEncryptionByDefaultInput
 	}
 
 	svc := handlers_ec2_account.NewNATSAccountSettingsService(natsConn)
-	result, err := svc.DisableEbsEncryptionByDefault(input)
+	result, err := svc.DisableEbsEncryptionByDefault(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/account/DisableSerialConsoleAccess.go b/hive/gateway/ec2/account/DisableSerialConsoleAccess.go
index f02d16189..10cd0c23f 100644
--- a/hive/gateway/ec2/account/DisableSerialConsoleAccess.go
+++ b/hive/gateway/ec2/account/DisableSerialConsoleAccess.go
@@ -16,7 +16,7 @@ func ValidateDisableSerialConsoleAccessInput(input *ec2.DisableSerialConsoleAcce
 	return nil
 }
 
-func DisableSerialConsoleAccess(input *ec2.DisableSerialConsoleAccessInput, natsConn *nats.Conn) (ec2.DisableSerialConsoleAccessOutput, error) {
+func DisableSerialConsoleAccess(input *ec2.DisableSerialConsoleAccessInput, natsConn *nats.Conn, accountID string) (ec2.DisableSerialConsoleAccessOutput, error) {
 	var output ec2.DisableSerialConsoleAccessOutput
 
 	if err := ValidateDisableSerialConsoleAccessInput(input); err != nil {
@@ -24,7 +24,7 @@ func DisableSerialConsoleAccess(input *ec2.DisableSerialConsoleAccessInput, nats
 	}
 
 	svc := handlers_ec2_account.NewNATSAccountSettingsService(natsConn)
-	result, err := svc.DisableSerialConsoleAccess(input)
+	result, err := svc.DisableSerialConsoleAccess(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/account/EnableEbsEncryptionByDefault.go b/hive/gateway/ec2/account/EnableEbsEncryptionByDefault.go
index 608bbb4fe..f09100cab 100644
--- a/hive/gateway/ec2/account/EnableEbsEncryptionByDefault.go
+++ b/hive/gateway/ec2/account/EnableEbsEncryptionByDefault.go
@@ -16,7 +16,7 @@ func ValidateEnableEbsEncryptionByDefaultInput(input *ec2.EnableEbsEncryptionByD
 	return nil
 }
 
-func EnableEbsEncryptionByDefault(input *ec2.EnableEbsEncryptionByDefaultInput, natsConn *nats.Conn) (ec2.EnableEbsEncryptionByDefaultOutput, error) {
+func EnableEbsEncryptionByDefault(input *ec2.EnableEbsEncryptionByDefaultInput, natsConn *nats.Conn, accountID string) (ec2.EnableEbsEncryptionByDefaultOutput, error) {
 	var output ec2.EnableEbsEncryptionByDefaultOutput
 
 	if err := ValidateEnableEbsEncryptionByDefaultInput(input); err != nil {
@@ -24,7 +24,7 @@ func EnableEbsEncryptionByDefault(input *ec2.EnableEbsEncryptionByDefaultInput,
 	}
 
 	svc := handlers_ec2_account.NewNATSAccountSettingsService(natsConn)
-	result, err := svc.EnableEbsEncryptionByDefault(input)
+	result, err := svc.EnableEbsEncryptionByDefault(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/account/EnableSerialConsoleAccess.go b/hive/gateway/ec2/account/EnableSerialConsoleAccess.go
index 57d353f1f..e59bd70c0 100644
--- a/hive/gateway/ec2/account/EnableSerialConsoleAccess.go
+++ b/hive/gateway/ec2/account/EnableSerialConsoleAccess.go
@@ -16,7 +16,7 @@ func ValidateEnableSerialConsoleAccessInput(input *ec2.EnableSerialConsoleAccess
 	return nil
 }
 
-func EnableSerialConsoleAccess(input *ec2.EnableSerialConsoleAccessInput, natsConn *nats.Conn) (ec2.EnableSerialConsoleAccessOutput, error) {
+func EnableSerialConsoleAccess(input *ec2.EnableSerialConsoleAccessInput, natsConn *nats.Conn, accountID string) (ec2.EnableSerialConsoleAccessOutput, error) {
 	var output ec2.EnableSerialConsoleAccessOutput
 
 	if err := ValidateEnableSerialConsoleAccessInput(input); err != nil {
@@ -24,7 +24,7 @@ func EnableSerialConsoleAccess(input *ec2.EnableSerialConsoleAccessInput, natsCo
 	}
 
 	svc := handlers_ec2_account.NewNATSAccountSettingsService(natsConn)
-	result, err := svc.EnableSerialConsoleAccess(input)
+	result, err := svc.EnableSerialConsoleAccess(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/account/GetEbsEncryptionByDefault.go b/hive/gateway/ec2/account/GetEbsEncryptionByDefault.go
index 94736babe..82b458345 100644
--- a/hive/gateway/ec2/account/GetEbsEncryptionByDefault.go
+++ b/hive/gateway/ec2/account/GetEbsEncryptionByDefault.go
@@ -16,7 +16,7 @@ func ValidateGetEbsEncryptionByDefaultInput(input *ec2.GetEbsEncryptionByDefault
 	return nil
 }
 
-func GetEbsEncryptionByDefault(input *ec2.GetEbsEncryptionByDefaultInput, natsConn *nats.Conn) (ec2.GetEbsEncryptionByDefaultOutput, error) {
+func GetEbsEncryptionByDefault(input *ec2.GetEbsEncryptionByDefaultInput, natsConn *nats.Conn, accountID string) (ec2.GetEbsEncryptionByDefaultOutput, error) {
 	var output ec2.GetEbsEncryptionByDefaultOutput
 
 	if err := ValidateGetEbsEncryptionByDefaultInput(input); err != nil {
@@ -24,7 +24,7 @@ func GetEbsEncryptionByDefault(input *ec2.GetEbsEncryptionByDefaultInput, natsCo
 	}
 
 	svc := handlers_ec2_account.NewNATSAccountSettingsService(natsConn)
-	result, err := svc.GetEbsEncryptionByDefault(input)
+	result, err := svc.GetEbsEncryptionByDefault(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/account/GetSerialConsoleAccessStatus.go b/hive/gateway/ec2/account/GetSerialConsoleAccessStatus.go
index a33e6a47e..02f0e50f6 100644
--- a/hive/gateway/ec2/account/GetSerialConsoleAccessStatus.go
+++ b/hive/gateway/ec2/account/GetSerialConsoleAccessStatus.go
@@ -16,7 +16,7 @@ func ValidateGetSerialConsoleAccessStatusInput(input *ec2.GetSerialConsoleAccess
 	return nil
 }
 
-func GetSerialConsoleAccessStatus(input *ec2.GetSerialConsoleAccessStatusInput, natsConn *nats.Conn) (ec2.GetSerialConsoleAccessStatusOutput, error) {
+func GetSerialConsoleAccessStatus(input *ec2.GetSerialConsoleAccessStatusInput, natsConn *nats.Conn, accountID string) (ec2.GetSerialConsoleAccessStatusOutput, error) {
 	var output ec2.GetSerialConsoleAccessStatusOutput
 
 	if err := ValidateGetSerialConsoleAccessStatusInput(input); err != nil {
@@ -24,7 +24,7 @@ func GetSerialConsoleAccessStatus(input *ec2.GetSerialConsoleAccessStatusInput,
 	}
 
 	svc := handlers_ec2_account.NewNATSAccountSettingsService(natsConn)
-	result, err := svc.GetSerialConsoleAccessStatus(input)
+	result, err := svc.GetSerialConsoleAccessStatus(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/eigw/CreateEgressOnlyInternetGateway.go b/hive/gateway/ec2/eigw/CreateEgressOnlyInternetGateway.go
index b4e1119fa..8c781f4f2 100644
--- a/hive/gateway/ec2/eigw/CreateEgressOnlyInternetGateway.go
+++ b/hive/gateway/ec2/eigw/CreateEgressOnlyInternetGateway.go
@@ -23,7 +23,7 @@ func ValidateCreateEgressOnlyInternetGatewayInput(input *ec2.CreateEgressOnlyInt
 }
 
 // CreateEgressOnlyInternetGateway handles the EC2 CreateEgressOnlyInternetGateway API call
-func CreateEgressOnlyInternetGateway(input *ec2.CreateEgressOnlyInternetGatewayInput, natsConn *nats.Conn) (ec2.CreateEgressOnlyInternetGatewayOutput, error) {
+func CreateEgressOnlyInternetGateway(input *ec2.CreateEgressOnlyInternetGatewayInput, natsConn *nats.Conn, accountID string) (ec2.CreateEgressOnlyInternetGatewayOutput, error) {
 	var output ec2.CreateEgressOnlyInternetGatewayOutput
 
 	if err := ValidateCreateEgressOnlyInternetGatewayInput(input); err != nil {
@@ -31,7 +31,7 @@ func CreateEgressOnlyInternetGateway(input *ec2.CreateEgressOnlyInternetGatewayI
 	}
 
 	svc := handlers_ec2_eigw.NewNATSEgressOnlyIGWService(natsConn)
-	result, err := svc.CreateEgressOnlyInternetGateway(input)
+	result, err := svc.CreateEgressOnlyInternetGateway(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/eigw/DeleteEgressOnlyInternetGateway.go b/hive/gateway/ec2/eigw/DeleteEgressOnlyInternetGateway.go
index 4169d24ce..f3f8a0f84 100644
--- a/hive/gateway/ec2/eigw/DeleteEgressOnlyInternetGateway.go
+++ b/hive/gateway/ec2/eigw/DeleteEgressOnlyInternetGateway.go
@@ -23,7 +23,7 @@ func ValidateDeleteEgressOnlyInternetGatewayInput(input *ec2.DeleteEgressOnlyInt
 }
 
 // DeleteEgressOnlyInternetGateway handles the EC2 DeleteEgressOnlyInternetGateway API call
-func DeleteEgressOnlyInternetGateway(input *ec2.DeleteEgressOnlyInternetGatewayInput, natsConn *nats.Conn) (ec2.DeleteEgressOnlyInternetGatewayOutput, error) {
+func DeleteEgressOnlyInternetGateway(input *ec2.DeleteEgressOnlyInternetGatewayInput, natsConn *nats.Conn, accountID string) (ec2.DeleteEgressOnlyInternetGatewayOutput, error) {
 	var output ec2.DeleteEgressOnlyInternetGatewayOutput
 
 	if err := ValidateDeleteEgressOnlyInternetGatewayInput(input); err != nil {
@@ -31,7 +31,7 @@ func DeleteEgressOnlyInternetGateway(input *ec2.DeleteEgressOnlyInternetGatewayI
 	}
 
 	svc := handlers_ec2_eigw.NewNATSEgressOnlyIGWService(natsConn)
-	result, err := svc.DeleteEgressOnlyInternetGateway(input)
+	result, err := svc.DeleteEgressOnlyInternetGateway(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/eigw/DescribeEgressOnlyInternetGateways.go b/hive/gateway/ec2/eigw/DescribeEgressOnlyInternetGateways.go
index 5373f980a..cb49c5e00 100644
--- a/hive/gateway/ec2/eigw/DescribeEgressOnlyInternetGateways.go
+++ b/hive/gateway/ec2/eigw/DescribeEgressOnlyInternetGateways.go
@@ -19,7 +19,7 @@ func ValidateDescribeEgressOnlyInternetGatewaysInput(input *ec2.DescribeEgressOn
 }
 
 // DescribeEgressOnlyInternetGateways handles the EC2 DescribeEgressOnlyInternetGateways API call
-func DescribeEgressOnlyInternetGateways(input *ec2.DescribeEgressOnlyInternetGatewaysInput, natsConn *nats.Conn) (ec2.DescribeEgressOnlyInternetGatewaysOutput, error) {
+func DescribeEgressOnlyInternetGateways(input *ec2.DescribeEgressOnlyInternetGatewaysInput, natsConn *nats.Conn, accountID string) (ec2.DescribeEgressOnlyInternetGatewaysOutput, error) {
 	var output ec2.DescribeEgressOnlyInternetGatewaysOutput
 
 	if err := ValidateDescribeEgressOnlyInternetGatewaysInput(input); err != nil {
@@ -27,7 +27,7 @@ func DescribeEgressOnlyInternetGateways(input *ec2.DescribeEgressOnlyInternetGat
 	}
 
 	svc := handlers_ec2_eigw.NewNATSEgressOnlyIGWService(natsConn)
-	result, err := svc.DescribeEgressOnlyInternetGateways(input)
+	result, err := svc.DescribeEgressOnlyInternetGateways(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/igw/AttachInternetGateway.go b/hive/gateway/ec2/igw/AttachInternetGateway.go
index 713baa702..8a67f25be 100644
--- a/hive/gateway/ec2/igw/AttachInternetGateway.go
+++ b/hive/gateway/ec2/igw/AttachInternetGateway.go
@@ -10,7 +10,7 @@ import (
 )
 
 // AttachInternetGateway handles the EC2 AttachInternetGateway API call
-func AttachInternetGateway(input *ec2.AttachInternetGatewayInput, natsConn *nats.Conn) (ec2.AttachInternetGatewayOutput, error) {
+func AttachInternetGateway(input *ec2.AttachInternetGatewayInput, natsConn *nats.Conn, accountID string) (ec2.AttachInternetGatewayOutput, error) {
 	var output ec2.AttachInternetGatewayOutput
 
 	if input == nil {
@@ -24,7 +24,7 @@ func AttachInternetGateway(input *ec2.AttachInternetGatewayInput, natsConn *nats
 	}
 
 	svc := handlers_ec2_igw.NewNATSIGWService(natsConn)
-	result, err := svc.AttachInternetGateway(input)
+	result, err := svc.AttachInternetGateway(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/igw/CreateInternetGateway.go b/hive/gateway/ec2/igw/CreateInternetGateway.go
index f5f8ca2d8..06e25db8a 100644
--- a/hive/gateway/ec2/igw/CreateInternetGateway.go
+++ b/hive/gateway/ec2/igw/CreateInternetGateway.go
@@ -10,7 +10,7 @@ import (
 )
 
 // CreateInternetGateway handles the EC2 CreateInternetGateway API call
-func CreateInternetGateway(input *ec2.CreateInternetGatewayInput, natsConn *nats.Conn) (ec2.CreateInternetGatewayOutput, error) {
+func CreateInternetGateway(input *ec2.CreateInternetGatewayInput, natsConn *nats.Conn, accountID string) (ec2.CreateInternetGatewayOutput, error) {
 	var output ec2.CreateInternetGatewayOutput
 
 	if input == nil {
@@ -18,7 +18,7 @@ func CreateInternetGateway(input *ec2.CreateInternetGatewayInput, natsConn *nats
 	}
 
 	svc := handlers_ec2_igw.NewNATSIGWService(natsConn)
-	result, err := svc.CreateInternetGateway(input)
+	result, err := svc.CreateInternetGateway(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/igw/DeleteInternetGateway.go b/hive/gateway/ec2/igw/DeleteInternetGateway.go
index 62dec95de..fed2cf37c 100644
--- a/hive/gateway/ec2/igw/DeleteInternetGateway.go
+++ b/hive/gateway/ec2/igw/DeleteInternetGateway.go
@@ -10,7 +10,7 @@ import (
 )
 
 // DeleteInternetGateway handles the EC2 DeleteInternetGateway API call
-func DeleteInternetGateway(input *ec2.DeleteInternetGatewayInput, natsConn *nats.Conn) (ec2.DeleteInternetGatewayOutput, error) {
+func DeleteInternetGateway(input *ec2.DeleteInternetGatewayInput, natsConn *nats.Conn, accountID string) (ec2.DeleteInternetGatewayOutput, error) {
 	var output ec2.DeleteInternetGatewayOutput
 
 	if input == nil {
@@ -21,7 +21,7 @@ func DeleteInternetGateway(input *ec2.DeleteInternetGatewayInput, natsConn *nats
 	}
 
 	svc := handlers_ec2_igw.NewNATSIGWService(natsConn)
-	result, err := svc.DeleteInternetGateway(input)
+	result, err := svc.DeleteInternetGateway(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/igw/DescribeInternetGateways.go b/hive/gateway/ec2/igw/DescribeInternetGateways.go
index a13d879be..3f8faeaed 100644
--- a/hive/gateway/ec2/igw/DescribeInternetGateways.go
+++ b/hive/gateway/ec2/igw/DescribeInternetGateways.go
@@ -10,7 +10,7 @@ import (
 )
 
 // DescribeInternetGateways handles the EC2 DescribeInternetGateways API call
-func DescribeInternetGateways(input *ec2.DescribeInternetGatewaysInput, natsConn *nats.Conn) (ec2.DescribeInternetGatewaysOutput, error) {
+func DescribeInternetGateways(input *ec2.DescribeInternetGatewaysInput, natsConn *nats.Conn, accountID string) (ec2.DescribeInternetGatewaysOutput, error) {
 	var output ec2.DescribeInternetGatewaysOutput
 
 	if input == nil {
@@ -18,7 +18,7 @@ func DescribeInternetGateways(input *ec2.DescribeInternetGatewaysInput, natsConn
 	}
 
 	svc := handlers_ec2_igw.NewNATSIGWService(natsConn)
-	result, err := svc.DescribeInternetGateways(input)
+	result, err := svc.DescribeInternetGateways(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/igw/DetachInternetGateway.go b/hive/gateway/ec2/igw/DetachInternetGateway.go
index ec6271644..8e478e4df 100644
--- a/hive/gateway/ec2/igw/DetachInternetGateway.go
+++ b/hive/gateway/ec2/igw/DetachInternetGateway.go
@@ -10,7 +10,7 @@ import (
 )
 
 // DetachInternetGateway handles the EC2 DetachInternetGateway API call
-func DetachInternetGateway(input *ec2.DetachInternetGatewayInput, natsConn *nats.Conn) (ec2.DetachInternetGatewayOutput, error) {
+func DetachInternetGateway(input *ec2.DetachInternetGatewayInput, natsConn *nats.Conn, accountID string) (ec2.DetachInternetGatewayOutput, error) {
 	var output ec2.DetachInternetGatewayOutput
 
 	if input == nil {
@@ -24,7 +24,7 @@ func DetachInternetGateway(input *ec2.DetachInternetGatewayInput, natsConn *nats
 	}
 
 	svc := handlers_ec2_igw.NewNATSIGWService(natsConn)
-	result, err := svc.DetachInternetGateway(input)
+	result, err := svc.DetachInternetGateway(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/igw/igw_test.go b/hive/gateway/ec2/igw/igw_test.go
index af36828b4..556419c9c 100644
--- a/hive/gateway/ec2/igw/igw_test.go
+++ b/hive/gateway/ec2/igw/igw_test.go
@@ -10,76 +10,76 @@ import (
 )
 
 func TestCreateInternetGateway_NilInput(t *testing.T) {
-	_, err := CreateInternetGateway(nil, nil)
+	_, err := CreateInternetGateway(nil, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestDeleteInternetGateway_NilInput(t *testing.T) {
-	_, err := DeleteInternetGateway(nil, nil)
+	_, err := DeleteInternetGateway(nil, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestDeleteInternetGateway_NilIGWId(t *testing.T) {
-	_, err := DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{}, nil)
+	_, err := DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDeleteInternetGateway_EmptyIGWId(t *testing.T) {
-	_, err := DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{InternetGatewayId: aws.String("")}, nil)
+	_, err := DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{InternetGatewayId: aws.String("")}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestAttachInternetGateway_NilInput(t *testing.T) {
-	_, err := AttachInternetGateway(nil, nil)
+	_, err := AttachInternetGateway(nil, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestAttachInternetGateway_NilIGWId(t *testing.T) {
-	_, err := AttachInternetGateway(&ec2.AttachInternetGatewayInput{VpcId: aws.String("vpc-123")}, nil)
+	_, err := AttachInternetGateway(&ec2.AttachInternetGatewayInput{VpcId: aws.String("vpc-123")}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestAttachInternetGateway_EmptyIGWId(t *testing.T) {
-	_, err := AttachInternetGateway(&ec2.AttachInternetGatewayInput{InternetGatewayId: aws.String(""), VpcId: aws.String("vpc-123")}, nil)
+	_, err := AttachInternetGateway(&ec2.AttachInternetGatewayInput{InternetGatewayId: aws.String(""), VpcId: aws.String("vpc-123")}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestAttachInternetGateway_NilVpcId(t *testing.T) {
-	_, err := AttachInternetGateway(&ec2.AttachInternetGatewayInput{InternetGatewayId: aws.String("igw-123")}, nil)
+	_, err := AttachInternetGateway(&ec2.AttachInternetGatewayInput{InternetGatewayId: aws.String("igw-123")}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestAttachInternetGateway_EmptyVpcId(t *testing.T) {
-	_, err := AttachInternetGateway(&ec2.AttachInternetGatewayInput{InternetGatewayId: aws.String("igw-123"), VpcId: aws.String("")}, nil)
+	_, err := AttachInternetGateway(&ec2.AttachInternetGatewayInput{InternetGatewayId: aws.String("igw-123"), VpcId: aws.String("")}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDetachInternetGateway_NilInput(t *testing.T) {
-	_, err := DetachInternetGateway(nil, nil)
+	_, err := DetachInternetGateway(nil, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestDetachInternetGateway_NilIGWId(t *testing.T) {
-	_, err := DetachInternetGateway(&ec2.DetachInternetGatewayInput{VpcId: aws.String("vpc-123")}, nil)
+	_, err := DetachInternetGateway(&ec2.DetachInternetGatewayInput{VpcId: aws.String("vpc-123")}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDetachInternetGateway_EmptyIGWId(t *testing.T) {
-	_, err := DetachInternetGateway(&ec2.DetachInternetGatewayInput{InternetGatewayId: aws.String(""), VpcId: aws.String("vpc-123")}, nil)
+	_, err := DetachInternetGateway(&ec2.DetachInternetGatewayInput{InternetGatewayId: aws.String(""), VpcId: aws.String("vpc-123")}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDetachInternetGateway_NilVpcId(t *testing.T) {
-	_, err := DetachInternetGateway(&ec2.DetachInternetGatewayInput{InternetGatewayId: aws.String("igw-123")}, nil)
+	_, err := DetachInternetGateway(&ec2.DetachInternetGatewayInput{InternetGatewayId: aws.String("igw-123")}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDetachInternetGateway_EmptyVpcId(t *testing.T) {
-	_, err := DetachInternetGateway(&ec2.DetachInternetGatewayInput{InternetGatewayId: aws.String("igw-123"), VpcId: aws.String("")}, nil)
+	_, err := DetachInternetGateway(&ec2.DetachInternetGatewayInput{InternetGatewayId: aws.String("igw-123"), VpcId: aws.String("")}, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDescribeInternetGateways_NilInput(t *testing.T) {
-	_, err := DescribeInternetGateways(nil, nil)
+	_, err := DescribeInternetGateways(nil, nil, "")
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
diff --git a/hive/gateway/ec2/image/CreateImage.go b/hive/gateway/ec2/image/CreateImage.go
index a28cc97ec..0f524dc1b 100644
--- a/hive/gateway/ec2/image/CreateImage.go
+++ b/hive/gateway/ec2/image/CreateImage.go
@@ -32,7 +32,7 @@ func ValidateCreateImageInput(input *ec2.CreateImageInput) error {
 }
 
 // CreateImage handles the EC2 CreateImage API call
-func CreateImage(input *ec2.CreateImageInput, natsConn *nats.Conn) (ec2.CreateImageOutput, error) {
+func CreateImage(input *ec2.CreateImageInput, natsConn *nats.Conn, accountID string) (ec2.CreateImageOutput, error) {
 	var output ec2.CreateImageOutput
 
 	if err := ValidateCreateImageInput(input); err != nil {
@@ -40,7 +40,7 @@ func CreateImage(input *ec2.CreateImageInput, natsConn *nats.Conn) (ec2.CreateIm
 	}
 
 	svc := handlers_ec2_image.NewNATSImageService(natsConn)
-	result, err := svc.CreateImage(input)
+	result, err := svc.CreateImage(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/image/DescribeImages.go b/hive/gateway/ec2/image/DescribeImages.go
index 28d819cf6..e3c46c79e 100644
--- a/hive/gateway/ec2/image/DescribeImages.go
+++ b/hive/gateway/ec2/image/DescribeImages.go
@@ -27,7 +27,7 @@ func ValidateDescribeImagesInput(input *ec2.DescribeImagesInput) (err error) {
 	return
 }
 
-func DescribeImages(input *ec2.DescribeImagesInput, natsConn *nats.Conn) (output ec2.DescribeImagesOutput, err error) {
+func DescribeImages(input *ec2.DescribeImagesInput, natsConn *nats.Conn, accountID string) (output ec2.DescribeImagesOutput, err error) {
 
 	// Validate input
 	err = ValidateDescribeImagesInput(input)
@@ -38,7 +38,7 @@ func DescribeImages(input *ec2.DescribeImagesInput, natsConn *nats.Conn) (output
 
 	// Create NATS service and call handler
 	imageService := handlers_ec2_image.NewNATSImageService(natsConn)
-	result, err := imageService.DescribeImages(input)
+	result, err := imageService.DescribeImages(input, accountID)
 
 	if err != nil {
 		return output, err
diff --git a/hive/gateway/ec2/instance/DescribeInstances.go b/hive/gateway/ec2/instance/DescribeInstances.go
index 2c01a892f..c8cbf1b87 100644
--- a/hive/gateway/ec2/instance/DescribeInstances.go
+++ b/hive/gateway/ec2/instance/DescribeInstances.go
@@ -13,7 +13,7 @@ import (
 
 // DescribeInstances queries all hive nodes for their instances via NATS
 // and aggregates the results into a single response
-func DescribeInstances(input *ec2.DescribeInstancesInput, natsConn *nats.Conn, expectedNodes int) (*ec2.DescribeInstancesOutput, error) {
+func DescribeInstances(input *ec2.DescribeInstancesInput, natsConn *nats.Conn, expectedNodes int, accountID string) (*ec2.DescribeInstancesOutput, error) {
 	// Marshal input to JSON
 	jsonData, err := json.Marshal(input)
 	if err != nil {
@@ -30,8 +30,12 @@ func DescribeInstances(input *ec2.DescribeInstancesInput, natsConn *nats.Conn, e
 	}
 	defer sub.Unsubscribe()
 
-	// Publish request to all nodes (no queue group, so all daemons receive it)
-	err = natsConn.PublishRequest("ec2.DescribeInstances", inbox, jsonData)
+	// Publish request to all nodes with account ID header
+	pubMsg := nats.NewMsg("ec2.DescribeInstances")
+	pubMsg.Reply = inbox
+	pubMsg.Data = jsonData
+	pubMsg.Header.Set(utils.AccountIDHeader, accountID)
+	err = natsConn.PublishMsg(pubMsg)
 	if err != nil {
 		slog.Error("DescribeInstances: Failed to publish request", "err", err)
 		return nil, fmt.Errorf("failed to publish request: %w", err)
@@ -102,7 +106,10 @@ func DescribeInstances(input *ec2.DescribeInstancesInput, natsConn *nats.Conn, e
 	}
 
 	// Query stopped instances from shared KV (via queue group — only one daemon handles it)
-	stoppedMsg, err := natsConn.Request("ec2.DescribeStoppedInstances", jsonData, 3*time.Second)
+	stoppedReqMsg := nats.NewMsg("ec2.DescribeStoppedInstances")
+	stoppedReqMsg.Data = jsonData
+	stoppedReqMsg.Header.Set(utils.AccountIDHeader, accountID)
+	stoppedMsg, err := natsConn.RequestMsg(stoppedReqMsg, 3*time.Second)
 	if err != nil {
 		slog.Warn("DescribeInstances: Failed to query stopped instances (may not be available)", "err", err)
 	} else {
diff --git a/hive/gateway/ec2/instance/DescribeInstances_test.go b/hive/gateway/ec2/instance/DescribeInstances_test.go
index 277767460..2b30d14ee 100644
--- a/hive/gateway/ec2/instance/DescribeInstances_test.go
+++ b/hive/gateway/ec2/instance/DescribeInstances_test.go
@@ -36,7 +36,7 @@ func TestDescribeInstances_SingleNode(t *testing.T) {
 	require.NoError(t, err)
 
 	input := &ec2.DescribeInstancesInput{}
-	output, err := DescribeInstances(input, nc, 1)
+	output, err := DescribeInstances(input, nc, 1, "123456789012")
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -87,7 +87,7 @@ func TestDescribeInstances_MultipleNodes(t *testing.T) {
 	nc2.Flush()
 
 	input := &ec2.DescribeInstancesInput{}
-	output, err := DescribeInstances(input, nc, 2)
+	output, err := DescribeInstances(input, nc, 2, "123456789012")
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -98,7 +98,7 @@ func TestDescribeInstances_NoSubscribers(t *testing.T) {
 	_, nc := startTestNATSServer(t)
 
 	input := &ec2.DescribeInstancesInput{}
-	output, err := DescribeInstances(input, nc, 0)
+	output, err := DescribeInstances(input, nc, 0, "123456789012")
 
 	// No subscribers means timeout — function returns empty reservations, no error
 	require.NoError(t, err)
@@ -115,7 +115,7 @@ func TestDescribeInstances_NodeReturnsError(t *testing.T) {
 	})
 
 	input := &ec2.DescribeInstancesInput{}
-	output, err := DescribeInstances(input, nc, 1)
+	output, err := DescribeInstances(input, nc, 1, "123456789012")
 
 	// Error responses from nodes are logged but don't fail the overall call
 	require.NoError(t, err)
@@ -153,7 +153,7 @@ func TestDescribeInstances_MixedResponses(t *testing.T) {
 	nc2.Flush()
 
 	input := &ec2.DescribeInstancesInput{}
-	output, err := DescribeInstances(input, nc, 2)
+	output, err := DescribeInstances(input, nc, 2, "123456789012")
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -170,7 +170,7 @@ func TestDescribeInstances_MalformedJSON(t *testing.T) {
 	})
 
 	input := &ec2.DescribeInstancesInput{}
-	output, err := DescribeInstances(input, nc, 1)
+	output, err := DescribeInstances(input, nc, 1, "123456789012")
 
 	// Malformed JSON from a node is skipped, not fatal
 	require.NoError(t, err)
@@ -189,7 +189,7 @@ func TestDescribeInstances_EmptyReservations(t *testing.T) {
 	})
 
 	input := &ec2.DescribeInstancesInput{}
-	output, err := DescribeInstances(input, nc, 1)
+	output, err := DescribeInstances(input, nc, 1, "123456789012")
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -211,7 +211,7 @@ func TestDescribeInstances_TimeoutCollection(t *testing.T) {
 	})
 
 	input := &ec2.DescribeInstancesInput{}
-	output, err := DescribeInstances(input, nc, 0) // 0 = timeout-based collection
+	output, err := DescribeInstances(input, nc, 0, "123456789012") // 0 = timeout-based collection
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -232,7 +232,7 @@ func TestDescribeInstances_EarlyExitWithExpectedNodes(t *testing.T) {
 
 	input := &ec2.DescribeInstancesInput{}
 	start := time.Now()
-	output, err := DescribeInstances(input, nc, 1)
+	output, err := DescribeInstances(input, nc, 1, "123456789012")
 	duration := time.Since(start)
 
 	require.NoError(t, err)
@@ -250,7 +250,7 @@ func TestDescribeInstances_ClosedConnection(t *testing.T) {
 	closedNC.Close()
 
 	input := &ec2.DescribeInstancesInput{}
-	_, err = DescribeInstances(input, closedNC, 1)
+	_, err = DescribeInstances(input, closedNC, 1, "123456789012")
 
 	require.Error(t, err)
 }
diff --git a/hive/gateway/ec2/instance/GetConsoleOutput.go b/hive/gateway/ec2/instance/GetConsoleOutput.go
index 2d3714757..760aca558 100644
--- a/hive/gateway/ec2/instance/GetConsoleOutput.go
+++ b/hive/gateway/ec2/instance/GetConsoleOutput.go
@@ -8,14 +8,13 @@ import (
 	"time"
 
 	"github.com/aws/aws-sdk-go/service/ec2"
-	"github.com/nats-io/nats.go"
-
 	"github.com/mulgadc/hive/hive/utils"
+	"github.com/nats-io/nats.go"
 )
 
 // GetConsoleOutput retrieves console output for a specific instance via NATS.
 // Routes directly to the node running the instance via ec2.{instanceID}.GetConsoleOutput.
-func GetConsoleOutput(input *ec2.GetConsoleOutputInput, natsConn *nats.Conn) (*ec2.GetConsoleOutputOutput, error) {
+func GetConsoleOutput(input *ec2.GetConsoleOutputInput, natsConn *nats.Conn, accountID string) (*ec2.GetConsoleOutputOutput, error) {
 	if input.InstanceId == nil || *input.InstanceId == "" {
 		return nil, fmt.Errorf("InstanceId is required")
 	}
@@ -26,7 +25,10 @@ func GetConsoleOutput(input *ec2.GetConsoleOutputInput, natsConn *nats.Conn) (*e
 	}
 
 	topic := fmt.Sprintf("ec2.%s.GetConsoleOutput", *input.InstanceId)
-	msg, err := natsConn.Request(topic, jsonData, 5*time.Second)
+	reqMsg := nats.NewMsg(topic)
+	reqMsg.Data = jsonData
+	reqMsg.Header.Set(utils.AccountIDHeader, accountID)
+	msg, err := natsConn.RequestMsg(reqMsg, 5*time.Second)
 	if err != nil {
 		if err == nats.ErrNoResponders || err == nats.ErrTimeout {
 			return nil, fmt.Errorf("instance %s not found or not running", *input.InstanceId)
diff --git a/hive/gateway/ec2/instance/ModifyInstanceAttribute.go b/hive/gateway/ec2/instance/ModifyInstanceAttribute.go
index 00540ba42..d4431b138 100644
--- a/hive/gateway/ec2/instance/ModifyInstanceAttribute.go
+++ b/hive/gateway/ec2/instance/ModifyInstanceAttribute.go
@@ -49,7 +49,7 @@ func ValidateModifyInstanceAttributeInput(input *ec2.ModifyInstanceAttributeInpu
 
 // ModifyInstanceAttribute sends a modify request to the daemon via NATS.
 // The daemon updates the stopped instance in KV and returns an empty response on success.
-func ModifyInstanceAttribute(input *ec2.ModifyInstanceAttributeInput, natsConn *nats.Conn) (ec2.ModifyInstanceAttributeOutput, error) {
+func ModifyInstanceAttribute(input *ec2.ModifyInstanceAttributeInput, natsConn *nats.Conn, accountID string) (ec2.ModifyInstanceAttributeOutput, error) {
 	if err := ValidateModifyInstanceAttributeInput(input); err != nil {
 		return ec2.ModifyInstanceAttributeOutput{}, err
 	}
@@ -62,7 +62,10 @@ func ModifyInstanceAttribute(input *ec2.ModifyInstanceAttributeInput, natsConn *
 		return ec2.ModifyInstanceAttributeOutput{}, fmt.Errorf("failed to marshal request: %w", err)
 	}
 
-	msg, err := natsConn.Request("ec2.ModifyInstanceAttribute", jsonData, 30*time.Second)
+	reqMsg := nats.NewMsg("ec2.ModifyInstanceAttribute")
+	reqMsg.Data = jsonData
+	reqMsg.Header.Set(utils.AccountIDHeader, accountID)
+	msg, err := natsConn.RequestMsg(reqMsg, 30*time.Second)
 	if err != nil {
 		slog.Error("ModifyInstanceAttribute: Failed to send request", "instance_id", *input.InstanceId, "err", err)
 		return ec2.ModifyInstanceAttributeOutput{}, fmt.Errorf("failed to send modify request: %w", err)
diff --git a/hive/gateway/ec2/instance/ModifyInstanceAttribute_test.go b/hive/gateway/ec2/instance/ModifyInstanceAttribute_test.go
index 5b89cd11c..8ed1044fc 100644
--- a/hive/gateway/ec2/instance/ModifyInstanceAttribute_test.go
+++ b/hive/gateway/ec2/instance/ModifyInstanceAttribute_test.go
@@ -113,7 +113,7 @@ func TestModifyInstanceAttribute_Success(t *testing.T) {
 		InstanceType: &ec2.AttributeValue{Value: aws.String("t3.medium")},
 	}
 
-	_, err := ModifyInstanceAttribute(input, nc)
+	_, err := ModifyInstanceAttribute(input, nc, "123456789012")
 	assert.NoError(t, err)
 }
 
@@ -129,7 +129,7 @@ func TestModifyInstanceAttribute_DaemonError(t *testing.T) {
 		InstanceType: &ec2.AttributeValue{Value: aws.String("t3.medium")},
 	}
 
-	_, err := ModifyInstanceAttribute(input, nc)
+	_, err := ModifyInstanceAttribute(input, nc, "123456789012")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidInstanceIDNotFound, err.Error())
 }
@@ -137,7 +137,7 @@ func TestModifyInstanceAttribute_DaemonError(t *testing.T) {
 func TestModifyInstanceAttribute_ValidationFailure(t *testing.T) {
 	_, nc := startTestNATSServer(t)
 
-	_, err := ModifyInstanceAttribute(nil, nc)
+	_, err := ModifyInstanceAttribute(nil, nc, "123456789012")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidParameterValue, err.Error())
 }
diff --git a/hive/gateway/ec2/instance/RunInstances.go b/hive/gateway/ec2/instance/RunInstances.go
index e46a8ebf9..fe6e9ff51 100644
--- a/hive/gateway/ec2/instance/RunInstances.go
+++ b/hive/gateway/ec2/instance/RunInstances.go
@@ -56,7 +56,7 @@ func ValidateRunInstancesInput(input *ec2.RunInstancesInput) (err error) {
 
 }
 
-func RunInstances(input *ec2.RunInstancesInput, natsConn *nats.Conn) (reservation ec2.Reservation, err error) {
+func RunInstances(input *ec2.RunInstancesInput, natsConn *nats.Conn, accountID string) (reservation ec2.Reservation, err error) {
 
 	// Validate input
 	err = ValidateRunInstancesInput(input)
@@ -69,7 +69,7 @@ func RunInstances(input *ec2.RunInstancesInput, natsConn *nats.Conn) (reservatio
 	service := handlers_ec2_instance.NewNATSInstanceService(natsConn)
 
 	// Call the service directly (no need for JSON marshaling/unmarshaling in same process)
-	reservationPtr, err := service.RunInstances(input)
+	reservationPtr, err := service.RunInstances(input, accountID)
 	if err != nil {
 		if errors.Is(err, nats.ErrNoResponders) {
 			// ErrNoResponders means no daemon subscribes to ec2.RunInstances.{type}.
@@ -90,7 +90,7 @@ func RunInstances(input *ec2.RunInstancesInput, natsConn *nats.Conn) (reservatio
 // isKnownInstanceType checks whether any daemon recognizes the given instance type.
 func isKnownInstanceType(natsConn *nats.Conn, instanceType string) bool {
 	result, err := utils.NATSRequest[ec2.DescribeInstanceTypesOutput](
-		natsConn, "ec2.DescribeInstanceTypes", &ec2.DescribeInstanceTypesInput{}, 3*time.Second)
+		natsConn, "ec2.DescribeInstanceTypes", &ec2.DescribeInstanceTypesInput{}, 3*time.Second, "")
 	if err != nil || result == nil {
 		return false
 	}
diff --git a/hive/gateway/ec2/instance/RunInstances_test.go b/hive/gateway/ec2/instance/RunInstances_test.go
index 22ff4df7d..59ee20e18 100644
--- a/hive/gateway/ec2/instance/RunInstances_test.go
+++ b/hive/gateway/ec2/instance/RunInstances_test.go
@@ -202,7 +202,7 @@ func TestParseRunInstances(t *testing.T) {
 			}
 
 			// For validation tests, we can pass nil conn since validation happens before NATS call
-			response, err := RunInstances(test.input, nil)
+			response, err := RunInstances(test.input, nil, "123456789012")
 
 			// Use assert to check if the error is as expected
 			assert.Equal(t, test.want, err)
diff --git a/hive/gateway/ec2/instance/StartInstances.go b/hive/gateway/ec2/instance/StartInstances.go
index e78d808c2..be0143815 100644
--- a/hive/gateway/ec2/instance/StartInstances.go
+++ b/hive/gateway/ec2/instance/StartInstances.go
@@ -19,7 +19,7 @@ type startStoppedInstanceRequest struct {
 
 // StartInstances sends start requests to the ec2.start queue group topic.
 // Any available daemon can pick up the request and launch the stopped instance.
-func StartInstances(input *ec2.StartInstancesInput, natsConn *nats.Conn) (*ec2.StartInstancesOutput, error) {
+func StartInstances(input *ec2.StartInstancesInput, natsConn *nats.Conn, accountID string) (*ec2.StartInstancesOutput, error) {
 	if len(input.InstanceIds) == 0 {
 		return nil, fmt.Errorf("no instance IDs provided")
 	}
@@ -43,7 +43,10 @@ func StartInstances(input *ec2.StartInstancesInput, natsConn *nats.Conn) (*ec2.S
 
 		slog.Info("StartInstances: Sending NATS request", "subject", "ec2.start", "instance_id", instanceID)
 
-		msg, err := natsConn.Request("ec2.start", jsonData, 30*time.Second)
+		reqMsg := nats.NewMsg("ec2.start")
+		reqMsg.Data = jsonData
+		reqMsg.Header.Set(utils.AccountIDHeader, accountID)
+		msg, err := natsConn.RequestMsg(reqMsg, 30*time.Second)
 		if err != nil {
 			slog.Error("StartInstances: Failed to send start request", "instance_id", instanceID, "err", err)
 			stateChanges = append(stateChanges, newStateChange(instanceID, 80, "stopped", 80, "stopped"))
diff --git a/hive/gateway/ec2/instance/StartInstances_test.go b/hive/gateway/ec2/instance/StartInstances_test.go
index 5e25ea517..e712b5824 100644
--- a/hive/gateway/ec2/instance/StartInstances_test.go
+++ b/hive/gateway/ec2/instance/StartInstances_test.go
@@ -31,7 +31,7 @@ func TestStartInstances_Success(t *testing.T) {
 		InstanceIds: []*string{aws.String(instanceID)},
 	}
 
-	output, err := StartInstances(input, nc)
+	output, err := StartInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -61,7 +61,7 @@ func TestStartInstances_MultipleInstances(t *testing.T) {
 		InstanceIds: []*string{aws.String(ids[0]), aws.String(ids[1]), aws.String(ids[2])},
 	}
 
-	output, err := StartInstances(input, nc)
+	output, err := StartInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -80,7 +80,7 @@ func TestStartInstances_EmptyInstanceIds(t *testing.T) {
 		InstanceIds: []*string{},
 	}
 
-	_, err := StartInstances(input, nc)
+	_, err := StartInstances(input, nc, "123456789012")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "no instance IDs provided")
 }
@@ -97,7 +97,7 @@ func TestStartInstances_NilInstanceIdSkipped(t *testing.T) {
 		InstanceIds: []*string{nil, aws.String(instanceID), nil},
 	}
 
-	output, err := StartInstances(input, nc)
+	output, err := StartInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -116,7 +116,7 @@ func TestStartInstances_NATSRequestFails(t *testing.T) {
 		InstanceIds: []*string{aws.String(instanceID)},
 	}
 
-	output, err := StartInstances(input, nc)
+	output, err := StartInstances(input, nc, "123456789012")
 
 	require.NoError(t, err) // Function itself doesn't error, it records state change
 	require.NotNil(t, output)
@@ -153,7 +153,7 @@ func TestStartInstances_MixedSuccessAndFailure(t *testing.T) {
 		InstanceIds: []*string{aws.String(goodID), aws.String(badID)},
 	}
 
-	_, err := StartInstances(input, nc)
+	_, err := StartInstances(input, nc, "123456789012")
 
 	// Daemon error for any instance should fail the whole call
 	require.Error(t, err)
diff --git a/hive/gateway/ec2/instance/StopInstances.go b/hive/gateway/ec2/instance/StopInstances.go
index c6491686f..38f3d9f57 100644
--- a/hive/gateway/ec2/instance/StopInstances.go
+++ b/hive/gateway/ec2/instance/StopInstances.go
@@ -2,18 +2,20 @@ package gateway_ec2_instance
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"time"
 
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/mulgadc/hive/hive/qmp"
+	"github.com/mulgadc/hive/hive/utils"
 	"github.com/nats-io/nats.go"
 )
 
 // StopInstances sends stop commands to specified instances via NATS
 // Uses system_powerdown with stop_instance attribute to prevent auto-restart on daemon boot
-func StopInstances(input *ec2.StopInstancesInput, natsConn *nats.Conn) (*ec2.StopInstancesOutput, error) {
+func StopInstances(input *ec2.StopInstancesInput, natsConn *nats.Conn, accountID string) (*ec2.StopInstancesOutput, error) {
 	if len(input.InstanceIds) == 0 {
 		return nil, fmt.Errorf("no instance IDs provided")
 	}
@@ -50,15 +52,24 @@ func StopInstances(input *ec2.StopInstancesInput, natsConn *nats.Conn) (*ec2.Sto
 			continue
 		}
 
-		// Send NATS request to the specific instance topic
+		// Send NATS request to the specific instance topic with account ID header
 		subject := fmt.Sprintf("ec2.cmd.%s", instanceID)
-		msg, err := natsConn.Request(subject, jsonData, 5*time.Second)
+		reqMsg := nats.NewMsg(subject)
+		reqMsg.Data = jsonData
+		reqMsg.Header.Set(utils.AccountIDHeader, accountID)
+		msg, err := natsConn.RequestMsg(reqMsg, 5*time.Second)
 		if err != nil {
 			slog.Error("StopInstances: Failed to send command", "instance_id", instanceID, "err", err)
 			stateChanges = append(stateChanges, newStateChange(instanceID, 16, "running", 16, "running"))
 			continue
 		}
 
+		// Check if the daemon returned an error response (e.g. ownership check failure)
+		if responseError, parseErr := utils.ValidateErrorPayload(msg.Data); parseErr != nil {
+			slog.Error("StopInstances: Daemon returned error", "instance_id", instanceID, "code", *responseError.Code)
+			return nil, errors.New(*responseError.Code)
+		}
+
 		slog.Info("StopInstances: Command sent successfully", "instance_id", instanceID, "response", string(msg.Data))
 
 		stateChanges = append(stateChanges, newStateChange(instanceID, 64, "stopping", 16, "running"))
diff --git a/hive/gateway/ec2/instance/StopInstances_test.go b/hive/gateway/ec2/instance/StopInstances_test.go
index 007d4983f..53f155229 100644
--- a/hive/gateway/ec2/instance/StopInstances_test.go
+++ b/hive/gateway/ec2/instance/StopInstances_test.go
@@ -34,7 +34,7 @@ func TestStopInstances_Success(t *testing.T) {
 		InstanceIds: []*string{aws.String(instanceID)},
 	}
 
-	output, err := StopInstances(input, nc)
+	output, err := StopInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -63,7 +63,7 @@ func TestStopInstances_MultipleInstances(t *testing.T) {
 		InstanceIds: []*string{aws.String(ids[0]), aws.String(ids[1])},
 	}
 
-	output, err := StopInstances(input, nc)
+	output, err := StopInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.Len(t, output.StoppingInstances, 2)
@@ -82,7 +82,7 @@ func TestStopInstances_EmptyInstanceIds(t *testing.T) {
 		InstanceIds: []*string{},
 	}
 
-	_, err := StopInstances(input, nc)
+	_, err := StopInstances(input, nc, "123456789012")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "no instance IDs provided")
 }
@@ -99,7 +99,7 @@ func TestStopInstances_NilInstanceIdSkipped(t *testing.T) {
 		InstanceIds: []*string{nil, aws.String(instanceID)},
 	}
 
-	output, err := StopInstances(input, nc)
+	output, err := StopInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	assert.Len(t, output.StoppingInstances, 1)
@@ -115,7 +115,7 @@ func TestStopInstances_NATSRequestFails(t *testing.T) {
 		InstanceIds: []*string{aws.String(instanceID)},
 	}
 
-	output, err := StopInstances(input, nc)
+	output, err := StopInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.Len(t, output.StoppingInstances, 1)
@@ -143,7 +143,7 @@ func TestStopInstances_MixedSuccessAndFailure(t *testing.T) {
 		InstanceIds: []*string{aws.String(goodID), aws.String(badID)},
 	}
 
-	output, err := StopInstances(input, nc)
+	output, err := StopInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.Len(t, output.StoppingInstances, 2)
diff --git a/hive/gateway/ec2/instance/TerminateInstances.go b/hive/gateway/ec2/instance/TerminateInstances.go
index fb475f0c4..dcf33fdd1 100644
--- a/hive/gateway/ec2/instance/TerminateInstances.go
+++ b/hive/gateway/ec2/instance/TerminateInstances.go
@@ -20,7 +20,7 @@ type terminateStoppedInstanceRequest struct {
 
 // TerminateInstances sends terminate commands to specified instances via NATS
 // Uses system_powerdown with stop_instance attribute to prevent restart
-func TerminateInstances(input *ec2.TerminateInstancesInput, natsConn *nats.Conn) (*ec2.TerminateInstancesOutput, error) {
+func TerminateInstances(input *ec2.TerminateInstancesInput, natsConn *nats.Conn, accountID string) (*ec2.TerminateInstancesOutput, error) {
 	if len(input.InstanceIds) == 0 {
 		return nil, fmt.Errorf("no instance IDs provided")
 	}
@@ -57,16 +57,22 @@ func TerminateInstances(input *ec2.TerminateInstancesInput, natsConn *nats.Conn)
 			continue
 		}
 
-		// Send NATS request to the specific instance topic
+		// Send NATS request to the specific instance topic with account ID header
 		subject := fmt.Sprintf("ec2.cmd.%s", instanceID)
-		msg, err := natsConn.Request(subject, jsonData, 5*time.Second)
+		reqMsg := nats.NewMsg(subject)
+		reqMsg.Data = jsonData
+		reqMsg.Header.Set(utils.AccountIDHeader, accountID)
+		msg, err := natsConn.RequestMsg(reqMsg, 5*time.Second)
 		if err != nil {
 			// If no daemon owns this instance, try the ec2.terminate topic for stopped instances
 			if errors.Is(err, nats.ErrNoResponders) {
 				slog.Info("TerminateInstances: No responder on per-instance topic, trying ec2.terminate", "instance_id", instanceID)
 
 				terminateReq, _ := json.Marshal(terminateStoppedInstanceRequest{InstanceID: instanceID})
-				terminateMsg, terminateErr := natsConn.Request("ec2.terminate", terminateReq, 30*time.Second)
+				terminateReqMsg := nats.NewMsg("ec2.terminate")
+				terminateReqMsg.Data = terminateReq
+				terminateReqMsg.Header.Set(utils.AccountIDHeader, accountID)
+				terminateMsg, terminateErr := natsConn.RequestMsg(terminateReqMsg, 30*time.Second)
 				if terminateErr == nil {
 					if _, parseErr := utils.ValidateErrorPayload(terminateMsg.Data); parseErr == nil {
 						slog.Info("TerminateInstances: Stopped instance terminated via ec2.terminate", "instance_id", instanceID)
@@ -81,6 +87,12 @@ func TerminateInstances(input *ec2.TerminateInstancesInput, natsConn *nats.Conn)
 			continue
 		}
 
+		// Check if the daemon returned an error response (e.g. ownership check failure)
+		if responseError, parseErr := utils.ValidateErrorPayload(msg.Data); parseErr != nil {
+			slog.Error("TerminateInstances: Daemon returned error", "instance_id", instanceID, "code", *responseError.Code)
+			return nil, errors.New(*responseError.Code)
+		}
+
 		slog.Info("TerminateInstances: Command sent successfully", "instance_id", instanceID, "response", string(msg.Data))
 
 		stateChanges = append(stateChanges, newStateChange(instanceID, 32, "shutting-down", 16, "running"))
diff --git a/hive/gateway/ec2/instance/TerminateInstances_test.go b/hive/gateway/ec2/instance/TerminateInstances_test.go
index ada962794..c40be942d 100644
--- a/hive/gateway/ec2/instance/TerminateInstances_test.go
+++ b/hive/gateway/ec2/instance/TerminateInstances_test.go
@@ -34,7 +34,7 @@ func TestTerminateInstances_Success(t *testing.T) {
 		InstanceIds: []*string{aws.String(instanceID)},
 	}
 
-	output, err := TerminateInstances(input, nc)
+	output, err := TerminateInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.NotNil(t, output)
@@ -63,7 +63,7 @@ func TestTerminateInstances_MultipleInstances(t *testing.T) {
 		InstanceIds: []*string{aws.String(ids[0]), aws.String(ids[1]), aws.String(ids[2])},
 	}
 
-	output, err := TerminateInstances(input, nc)
+	output, err := TerminateInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.Len(t, output.TerminatingInstances, 3)
@@ -82,7 +82,7 @@ func TestTerminateInstances_EmptyInstanceIds(t *testing.T) {
 		InstanceIds: []*string{},
 	}
 
-	_, err := TerminateInstances(input, nc)
+	_, err := TerminateInstances(input, nc, "123456789012")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "no instance IDs provided")
 }
@@ -99,7 +99,7 @@ func TestTerminateInstances_NilInstanceIdSkipped(t *testing.T) {
 		InstanceIds: []*string{nil, aws.String(instanceID), nil},
 	}
 
-	output, err := TerminateInstances(input, nc)
+	output, err := TerminateInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	assert.Len(t, output.TerminatingInstances, 1)
@@ -115,7 +115,7 @@ func TestTerminateInstances_NATSRequestFails(t *testing.T) {
 		InstanceIds: []*string{aws.String(instanceID)},
 	}
 
-	output, err := TerminateInstances(input, nc)
+	output, err := TerminateInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.Len(t, output.TerminatingInstances, 1)
@@ -143,7 +143,7 @@ func TestTerminateInstances_MixedSuccessAndFailure(t *testing.T) {
 		InstanceIds: []*string{aws.String(goodID), aws.String(badID)},
 	}
 
-	output, err := TerminateInstances(input, nc)
+	output, err := TerminateInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.Len(t, output.TerminatingInstances, 2)
@@ -172,7 +172,7 @@ func TestTerminateInstances_VerifiesQMPAttributes(t *testing.T) {
 		InstanceIds: []*string{aws.String(instanceID)},
 	}
 
-	_, err := TerminateInstances(input, nc)
+	_, err := TerminateInstances(input, nc, "123456789012")
 	require.NoError(t, err)
 
 	// Terminate should set both stop and terminate flags
@@ -199,7 +199,7 @@ func TestTerminateInstances_StoppedInstanceFallback(t *testing.T) {
 		InstanceIds: []*string{aws.String(instanceID)},
 	}
 
-	output, err := TerminateInstances(input, nc)
+	output, err := TerminateInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.Len(t, output.TerminatingInstances, 1)
@@ -234,7 +234,7 @@ func TestTerminateInstances_MixedRunningAndStopped(t *testing.T) {
 		InstanceIds: []*string{aws.String(runningID), aws.String(stoppedID)},
 	}
 
-	output, err := TerminateInstances(input, nc)
+	output, err := TerminateInstances(input, nc, "123456789012")
 
 	require.NoError(t, err)
 	require.Len(t, output.TerminatingInstances, 2)
diff --git a/hive/gateway/ec2/key/CreateKeyPair.go b/hive/gateway/ec2/key/CreateKeyPair.go
index e71029077..630d07aa7 100644
--- a/hive/gateway/ec2/key/CreateKeyPair.go
+++ b/hive/gateway/ec2/key/CreateKeyPair.go
@@ -22,7 +22,7 @@ func ValidateCreateKeyPairInput(input *ec2.CreateKeyPairInput) (err error) {
 	return
 }
 
-func CreateKeyPair(input *ec2.CreateKeyPairInput, natsConn *nats.Conn) (output ec2.CreateKeyPairOutput, err error) {
+func CreateKeyPair(input *ec2.CreateKeyPairInput, natsConn *nats.Conn, accountID string) (output ec2.CreateKeyPairOutput, err error) {
 
 	// Validate input
 	err = ValidateCreateKeyPairInput(input)
@@ -33,7 +33,7 @@ func CreateKeyPair(input *ec2.CreateKeyPairInput, natsConn *nats.Conn) (output e
 
 	// Create NATS key service and call CreateKeyPair
 	keyService := handlers_ec2_key.NewNATSKeyService(natsConn)
-	result, err := keyService.CreateKeyPair(input)
+	result, err := keyService.CreateKeyPair(input, accountID)
 
 	if err != nil {
 		slog.Error("CreateKeyPair failed", "err", err)
diff --git a/hive/gateway/ec2/key/DeleteKeyPair.go b/hive/gateway/ec2/key/DeleteKeyPair.go
index 3f7566c17..6e9e7228a 100644
--- a/hive/gateway/ec2/key/DeleteKeyPair.go
+++ b/hive/gateway/ec2/key/DeleteKeyPair.go
@@ -23,7 +23,7 @@ func ValidateDeleteKeyPairInput(input *ec2.DeleteKeyPairInput) (err error) {
 	return
 }
 
-func DeleteKeyPair(input *ec2.DeleteKeyPairInput, natsConn *nats.Conn) (output ec2.DeleteKeyPairOutput, err error) {
+func DeleteKeyPair(input *ec2.DeleteKeyPairInput, natsConn *nats.Conn, accountID string) (output ec2.DeleteKeyPairOutput, err error) {
 
 	// Validate input
 	err = ValidateDeleteKeyPairInput(input)
@@ -34,7 +34,7 @@ func DeleteKeyPair(input *ec2.DeleteKeyPairInput, natsConn *nats.Conn) (output e
 
 	// Create NATS key service and call DeleteKeyPair
 	keyService := handlers_ec2_key.NewNATSKeyService(natsConn)
-	result, err := keyService.DeleteKeyPair(input)
+	result, err := keyService.DeleteKeyPair(input, accountID)
 
 	if err != nil {
 		slog.Error("DeleteKeyPair failed", "err", err)
diff --git a/hive/gateway/ec2/key/DescribeKeyPairs.go b/hive/gateway/ec2/key/DescribeKeyPairs.go
index 76909b72b..6390b5c2c 100644
--- a/hive/gateway/ec2/key/DescribeKeyPairs.go
+++ b/hive/gateway/ec2/key/DescribeKeyPairs.go
@@ -7,12 +7,12 @@ import (
 )
 
 // DescribeKeyPairs lists key pairs via NATS
-func DescribeKeyPairs(input *ec2.DescribeKeyPairsInput, natsConn *nats.Conn) (output ec2.DescribeKeyPairsOutput, err error) {
+func DescribeKeyPairs(input *ec2.DescribeKeyPairsInput, natsConn *nats.Conn, accountID string) (output ec2.DescribeKeyPairsOutput, err error) {
 	// all input fields are optional filters
 
 	// Create NATS key service and call DescribeKeyPairs
 	keyService := handlers_ec2_key.NewNATSKeyService(natsConn)
-	result, err := keyService.DescribeKeyPairs(input)
+	result, err := keyService.DescribeKeyPairs(input, accountID)
 
 	if err != nil {
 		return output, err
diff --git a/hive/gateway/ec2/key/ImportKeyPair.go b/hive/gateway/ec2/key/ImportKeyPair.go
index 91c8cb304..030120aa0 100644
--- a/hive/gateway/ec2/key/ImportKeyPair.go
+++ b/hive/gateway/ec2/key/ImportKeyPair.go
@@ -25,7 +25,7 @@ func ValidateImportKeyPairInput(input *ec2.ImportKeyPairInput) (err error) {
 	return
 }
 
-func ImportKeyPair(input *ec2.ImportKeyPairInput, natsConn *nats.Conn) (output ec2.ImportKeyPairOutput, err error) {
+func ImportKeyPair(input *ec2.ImportKeyPairInput, natsConn *nats.Conn, accountID string) (output ec2.ImportKeyPairOutput, err error) {
 	// Validate input
 	err = ValidateImportKeyPairInput(input)
 
@@ -35,7 +35,7 @@ func ImportKeyPair(input *ec2.ImportKeyPairInput, natsConn *nats.Conn) (output e
 
 	// Create NATS key service and call ImportKeyPair
 	keyService := handlers_ec2_key.NewNATSKeyService(natsConn)
-	result, err := keyService.ImportKeyPair(input)
+	result, err := keyService.ImportKeyPair(input, accountID)
 
 	if err != nil {
 		return output, err
diff --git a/hive/gateway/ec2/snapshot/CopySnapshot.go b/hive/gateway/ec2/snapshot/CopySnapshot.go
index 0bb17b269..84eecf09b 100644
--- a/hive/gateway/ec2/snapshot/CopySnapshot.go
+++ b/hive/gateway/ec2/snapshot/CopySnapshot.go
@@ -32,7 +32,7 @@ func ValidateCopySnapshotInput(input *ec2.CopySnapshotInput) error {
 }
 
 // CopySnapshot handles the EC2 CopySnapshot API call
-func CopySnapshot(input *ec2.CopySnapshotInput, natsConn *nats.Conn) (ec2.CopySnapshotOutput, error) {
+func CopySnapshot(input *ec2.CopySnapshotInput, natsConn *nats.Conn, accountID string) (ec2.CopySnapshotOutput, error) {
 	var output ec2.CopySnapshotOutput
 
 	if err := ValidateCopySnapshotInput(input); err != nil {
@@ -40,7 +40,7 @@ func CopySnapshot(input *ec2.CopySnapshotInput, natsConn *nats.Conn) (ec2.CopySn
 	}
 
 	svc := handlers_ec2_snapshot.NewNATSSnapshotService(natsConn)
-	result, err := svc.CopySnapshot(input)
+	result, err := svc.CopySnapshot(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/snapshot/CreateSnapshot.go b/hive/gateway/ec2/snapshot/CreateSnapshot.go
index afbbd550e..dae299324 100644
--- a/hive/gateway/ec2/snapshot/CreateSnapshot.go
+++ b/hive/gateway/ec2/snapshot/CreateSnapshot.go
@@ -28,7 +28,7 @@ func ValidateCreateSnapshotInput(input *ec2.CreateSnapshotInput) error {
 }
 
 // CreateSnapshot handles the EC2 CreateSnapshot API call
-func CreateSnapshot(input *ec2.CreateSnapshotInput, natsConn *nats.Conn) (ec2.Snapshot, error) {
+func CreateSnapshot(input *ec2.CreateSnapshotInput, natsConn *nats.Conn, accountID string) (ec2.Snapshot, error) {
 	var output ec2.Snapshot
 
 	if err := ValidateCreateSnapshotInput(input); err != nil {
@@ -36,7 +36,7 @@ func CreateSnapshot(input *ec2.CreateSnapshotInput, natsConn *nats.Conn) (ec2.Sn
 	}
 
 	svc := handlers_ec2_snapshot.NewNATSSnapshotService(natsConn)
-	result, err := svc.CreateSnapshot(input)
+	result, err := svc.CreateSnapshot(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/snapshot/DeleteSnapshot.go b/hive/gateway/ec2/snapshot/DeleteSnapshot.go
index 62b9d3fbe..5c2c812ba 100644
--- a/hive/gateway/ec2/snapshot/DeleteSnapshot.go
+++ b/hive/gateway/ec2/snapshot/DeleteSnapshot.go
@@ -28,7 +28,7 @@ func ValidateDeleteSnapshotInput(input *ec2.DeleteSnapshotInput) error {
 }
 
 // DeleteSnapshot handles the EC2 DeleteSnapshot API call
-func DeleteSnapshot(input *ec2.DeleteSnapshotInput, natsConn *nats.Conn) (ec2.DeleteSnapshotOutput, error) {
+func DeleteSnapshot(input *ec2.DeleteSnapshotInput, natsConn *nats.Conn, accountID string) (ec2.DeleteSnapshotOutput, error) {
 	var output ec2.DeleteSnapshotOutput
 
 	if err := ValidateDeleteSnapshotInput(input); err != nil {
@@ -36,7 +36,7 @@ func DeleteSnapshot(input *ec2.DeleteSnapshotInput, natsConn *nats.Conn) (ec2.De
 	}
 
 	svc := handlers_ec2_snapshot.NewNATSSnapshotService(natsConn)
-	result, err := svc.DeleteSnapshot(input)
+	result, err := svc.DeleteSnapshot(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/snapshot/DescribeSnapshots.go b/hive/gateway/ec2/snapshot/DescribeSnapshots.go
index c2890d2f9..5ce9a7824 100644
--- a/hive/gateway/ec2/snapshot/DescribeSnapshots.go
+++ b/hive/gateway/ec2/snapshot/DescribeSnapshots.go
@@ -27,7 +27,7 @@ func ValidateDescribeSnapshotsInput(input *ec2.DescribeSnapshotsInput) error {
 }
 
 // DescribeSnapshots handles the EC2 DescribeSnapshots API call
-func DescribeSnapshots(input *ec2.DescribeSnapshotsInput, natsConn *nats.Conn) (ec2.DescribeSnapshotsOutput, error) {
+func DescribeSnapshots(input *ec2.DescribeSnapshotsInput, natsConn *nats.Conn, accountID string) (ec2.DescribeSnapshotsOutput, error) {
 	var output ec2.DescribeSnapshotsOutput
 
 	if err := ValidateDescribeSnapshotsInput(input); err != nil {
@@ -35,7 +35,7 @@ func DescribeSnapshots(input *ec2.DescribeSnapshotsInput, natsConn *nats.Conn) (
 	}
 
 	svc := handlers_ec2_snapshot.NewNATSSnapshotService(natsConn)
-	result, err := svc.DescribeSnapshots(input)
+	result, err := svc.DescribeSnapshots(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/tags/CreateTags.go b/hive/gateway/ec2/tags/CreateTags.go
index bdbe4b7b4..e0fe05580 100644
--- a/hive/gateway/ec2/tags/CreateTags.go
+++ b/hive/gateway/ec2/tags/CreateTags.go
@@ -34,7 +34,7 @@ func ValidateCreateTagsInput(input *ec2.CreateTagsInput) error {
 }
 
 // CreateTags handles the EC2 CreateTags API call
-func CreateTags(input *ec2.CreateTagsInput, natsConn *nats.Conn) (ec2.CreateTagsOutput, error) {
+func CreateTags(input *ec2.CreateTagsInput, natsConn *nats.Conn, accountID string) (ec2.CreateTagsOutput, error) {
 	var output ec2.CreateTagsOutput
 
 	if err := ValidateCreateTagsInput(input); err != nil {
@@ -42,7 +42,7 @@ func CreateTags(input *ec2.CreateTagsInput, natsConn *nats.Conn) (ec2.CreateTags
 	}
 
 	svc := handlers_ec2_tags.NewNATSTagsService(natsConn)
-	result, err := svc.CreateTags(input)
+	result, err := svc.CreateTags(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/tags/DeleteTags.go b/hive/gateway/ec2/tags/DeleteTags.go
index 428884ba3..ddad38bfb 100644
--- a/hive/gateway/ec2/tags/DeleteTags.go
+++ b/hive/gateway/ec2/tags/DeleteTags.go
@@ -23,7 +23,7 @@ func ValidateDeleteTagsInput(input *ec2.DeleteTagsInput) error {
 }
 
 // DeleteTags handles the EC2 DeleteTags API call
-func DeleteTags(input *ec2.DeleteTagsInput, natsConn *nats.Conn) (ec2.DeleteTagsOutput, error) {
+func DeleteTags(input *ec2.DeleteTagsInput, natsConn *nats.Conn, accountID string) (ec2.DeleteTagsOutput, error) {
 	var output ec2.DeleteTagsOutput
 
 	if err := ValidateDeleteTagsInput(input); err != nil {
@@ -31,7 +31,7 @@ func DeleteTags(input *ec2.DeleteTagsInput, natsConn *nats.Conn) (ec2.DeleteTags
 	}
 
 	svc := handlers_ec2_tags.NewNATSTagsService(natsConn)
-	result, err := svc.DeleteTags(input)
+	result, err := svc.DeleteTags(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/tags/DescribeTags.go b/hive/gateway/ec2/tags/DescribeTags.go
index de5ce7132..6f2b017f6 100644
--- a/hive/gateway/ec2/tags/DescribeTags.go
+++ b/hive/gateway/ec2/tags/DescribeTags.go
@@ -7,12 +7,12 @@ import (
 )
 
 // DescribeTags handles the EC2 DescribeTags API call
-func DescribeTags(input *ec2.DescribeTagsInput, natsConn *nats.Conn) (ec2.DescribeTagsOutput, error) {
+func DescribeTags(input *ec2.DescribeTagsInput, natsConn *nats.Conn, accountID string) (ec2.DescribeTagsOutput, error) {
 	// all input fields are optional filters
 	var output ec2.DescribeTagsOutput
 
 	svc := handlers_ec2_tags.NewNATSTagsService(natsConn)
-	result, err := svc.DescribeTags(input)
+	result, err := svc.DescribeTags(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/volume/AttachVolume.go b/hive/gateway/ec2/volume/AttachVolume.go
index 7944221d2..672851437 100644
--- a/hive/gateway/ec2/volume/AttachVolume.go
+++ b/hive/gateway/ec2/volume/AttachVolume.go
@@ -33,7 +33,7 @@ func ValidateAttachVolumeInput(input *ec2.AttachVolumeInput) error {
 }
 
 // AttachVolume sends an attach-volume command to the daemon owning the instance
-func AttachVolume(input *ec2.AttachVolumeInput, natsConn *nats.Conn) (ec2.VolumeAttachment, error) {
+func AttachVolume(input *ec2.AttachVolumeInput, natsConn *nats.Conn, accountID string) (ec2.VolumeAttachment, error) {
 	var output ec2.VolumeAttachment
 
 	if err := ValidateAttachVolumeInput(input); err != nil {
@@ -66,7 +66,10 @@ func AttachVolume(input *ec2.AttachVolumeInput, natsConn *nats.Conn) (ec2.Volume
 	}
 
 	subject := fmt.Sprintf("ec2.cmd.%s", instanceID)
-	msg, err := natsConn.Request(subject, jsonData, 30*time.Second)
+	reqMsg := nats.NewMsg(subject)
+	reqMsg.Data = jsonData
+	reqMsg.Header.Set(utils.AccountIDHeader, accountID)
+	msg, err := natsConn.RequestMsg(reqMsg, 30*time.Second)
 	if err != nil {
 		slog.Error("AttachVolume: NATS request failed", "instanceId", instanceID, "volumeId", volumeID, "err", err)
 		if errors.Is(err, nats.ErrNoResponders) {
diff --git a/hive/gateway/ec2/volume/CreateVolume.go b/hive/gateway/ec2/volume/CreateVolume.go
index d4a96b876..c16968fe7 100644
--- a/hive/gateway/ec2/volume/CreateVolume.go
+++ b/hive/gateway/ec2/volume/CreateVolume.go
@@ -32,7 +32,7 @@ func ValidateCreateVolumeInput(input *ec2.CreateVolumeInput) error {
 }
 
 // CreateVolume handles the CreateVolume API call
-func CreateVolume(input *ec2.CreateVolumeInput, natsConn *nats.Conn) (ec2.Volume, error) {
+func CreateVolume(input *ec2.CreateVolumeInput, natsConn *nats.Conn, accountID string) (ec2.Volume, error) {
 	var output ec2.Volume
 
 	err := ValidateCreateVolumeInput(input)
@@ -41,7 +41,7 @@ func CreateVolume(input *ec2.CreateVolumeInput, natsConn *nats.Conn) (ec2.Volume
 	}
 
 	volumeService := handlers_ec2_volume.NewNATSVolumeService(natsConn)
-	result, err := volumeService.CreateVolume(input)
+	result, err := volumeService.CreateVolume(input, accountID)
 
 	if err != nil {
 		return output, err
diff --git a/hive/gateway/ec2/volume/DeleteVolume.go b/hive/gateway/ec2/volume/DeleteVolume.go
index b0570a9ab..f2ed0f7ed 100644
--- a/hive/gateway/ec2/volume/DeleteVolume.go
+++ b/hive/gateway/ec2/volume/DeleteVolume.go
@@ -24,7 +24,7 @@ func ValidateDeleteVolumeInput(input *ec2.DeleteVolumeInput) error {
 }
 
 // DeleteVolume handles the DeleteVolume API call
-func DeleteVolume(input *ec2.DeleteVolumeInput, natsConn *nats.Conn) (ec2.DeleteVolumeOutput, error) {
+func DeleteVolume(input *ec2.DeleteVolumeInput, natsConn *nats.Conn, accountID string) (ec2.DeleteVolumeOutput, error) {
 	var output ec2.DeleteVolumeOutput
 
 	err := ValidateDeleteVolumeInput(input)
@@ -33,7 +33,7 @@ func DeleteVolume(input *ec2.DeleteVolumeInput, natsConn *nats.Conn) (ec2.Delete
 	}
 
 	volumeService := handlers_ec2_volume.NewNATSVolumeService(natsConn)
-	result, err := volumeService.DeleteVolume(input)
+	result, err := volumeService.DeleteVolume(input, accountID)
 
 	if err != nil {
 		return output, err
diff --git a/hive/gateway/ec2/volume/DescribeVolumeStatus.go b/hive/gateway/ec2/volume/DescribeVolumeStatus.go
index ea5b0049b..d8c66d42b 100644
--- a/hive/gateway/ec2/volume/DescribeVolumeStatus.go
+++ b/hive/gateway/ec2/volume/DescribeVolumeStatus.go
@@ -27,7 +27,7 @@ func ValidateDescribeVolumeStatusInput(input *ec2.DescribeVolumeStatusInput) err
 }
 
 // DescribeVolumeStatus handles the DescribeVolumeStatus API call
-func DescribeVolumeStatus(input *ec2.DescribeVolumeStatusInput, natsConn *nats.Conn) (ec2.DescribeVolumeStatusOutput, error) {
+func DescribeVolumeStatus(input *ec2.DescribeVolumeStatusInput, natsConn *nats.Conn, accountID string) (ec2.DescribeVolumeStatusOutput, error) {
 	var output ec2.DescribeVolumeStatusOutput
 
 	err := ValidateDescribeVolumeStatusInput(input)
@@ -36,7 +36,7 @@ func DescribeVolumeStatus(input *ec2.DescribeVolumeStatusInput, natsConn *nats.C
 	}
 
 	volumeService := handlers_ec2_volume.NewNATSVolumeService(natsConn)
-	result, err := volumeService.DescribeVolumeStatus(input)
+	result, err := volumeService.DescribeVolumeStatus(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/volume/DescribeVolumeStatus_test.go b/hive/gateway/ec2/volume/DescribeVolumeStatus_test.go
index 1e7bbacf2..9981fc6fb 100644
--- a/hive/gateway/ec2/volume/DescribeVolumeStatus_test.go
+++ b/hive/gateway/ec2/volume/DescribeVolumeStatus_test.go
@@ -54,7 +54,7 @@ func TestDescribeVolumeStatus_InputValidation(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			_, err := DescribeVolumeStatus(tt.input, nil)
+			_, err := DescribeVolumeStatus(tt.input, nil, "")
 
 			if tt.wantErr {
 				assert.Error(t, err)
diff --git a/hive/gateway/ec2/volume/DescribeVolumes.go b/hive/gateway/ec2/volume/DescribeVolumes.go
index 4805c4c35..ac99af06c 100644
--- a/hive/gateway/ec2/volume/DescribeVolumes.go
+++ b/hive/gateway/ec2/volume/DescribeVolumes.go
@@ -29,7 +29,7 @@ func ValidateDescribeVolumesInput(input *ec2.DescribeVolumesInput) error {
 }
 
 // DescribeVolumes handles the DescribeVolumes API call
-func DescribeVolumes(input *ec2.DescribeVolumesInput, natsConn *nats.Conn) (ec2.DescribeVolumesOutput, error) {
+func DescribeVolumes(input *ec2.DescribeVolumesInput, natsConn *nats.Conn, accountID string) (ec2.DescribeVolumesOutput, error) {
 	var output ec2.DescribeVolumesOutput
 
 	// Validate input
@@ -40,7 +40,7 @@ func DescribeVolumes(input *ec2.DescribeVolumesInput, natsConn *nats.Conn) (ec2.
 
 	// Create NATS service and call handler
 	volumeService := handlers_ec2_volume.NewNATSVolumeService(natsConn)
-	result, err := volumeService.DescribeVolumes(input)
+	result, err := volumeService.DescribeVolumes(input, accountID)
 
 	if err != nil {
 		return output, err
diff --git a/hive/gateway/ec2/volume/DetachVolume.go b/hive/gateway/ec2/volume/DetachVolume.go
index c191a5d6c..2d6340f60 100644
--- a/hive/gateway/ec2/volume/DetachVolume.go
+++ b/hive/gateway/ec2/volume/DetachVolume.go
@@ -29,7 +29,7 @@ func ValidateDetachVolumeInput(input *ec2.DetachVolumeInput) error {
 }
 
 // DetachVolume sends a detach-volume command to the daemon owning the instance
-func DetachVolume(input *ec2.DetachVolumeInput, natsConn *nats.Conn) (ec2.VolumeAttachment, error) {
+func DetachVolume(input *ec2.DetachVolumeInput, natsConn *nats.Conn, accountID string) (ec2.VolumeAttachment, error) {
 	var output ec2.VolumeAttachment
 
 	if err := ValidateDetachVolumeInput(input); err != nil {
@@ -46,7 +46,7 @@ func DetachVolume(input *ec2.DetachVolumeInput, natsConn *nats.Conn) (ec2.Volume
 		volSvc := handlers_ec2_volume.NewNATSVolumeService(natsConn)
 		descOutput, err := volSvc.DescribeVolumes(&ec2.DescribeVolumesInput{
 			VolumeIds: []*string{&volumeID},
-		})
+		}, accountID)
 		if err != nil {
 			slog.Error("DetachVolume: failed to describe volume", "volumeId", volumeID, "err", err)
 			return output, errors.New(awserrors.ErrorInvalidVolumeNotFound)
@@ -85,7 +85,10 @@ func DetachVolume(input *ec2.DetachVolumeInput, natsConn *nats.Conn) (ec2.Volume
 	}
 
 	subject := fmt.Sprintf("ec2.cmd.%s", instanceID)
-	msg, err := natsConn.Request(subject, jsonData, 30*time.Second)
+	reqMsg := nats.NewMsg(subject)
+	reqMsg.Data = jsonData
+	reqMsg.Header.Set(utils.AccountIDHeader, accountID)
+	msg, err := natsConn.RequestMsg(reqMsg, 30*time.Second)
 	if err != nil {
 		slog.Error("DetachVolume: NATS request failed", "instanceId", instanceID, "volumeId", volumeID, "err", err)
 		if errors.Is(err, nats.ErrNoResponders) {
diff --git a/hive/gateway/ec2/volume/ModifyVolume.go b/hive/gateway/ec2/volume/ModifyVolume.go
index 6152efad0..f3d4f2abc 100644
--- a/hive/gateway/ec2/volume/ModifyVolume.go
+++ b/hive/gateway/ec2/volume/ModifyVolume.go
@@ -28,7 +28,7 @@ func ValidateModifyVolumeInput(input *ec2.ModifyVolumeInput) error {
 }
 
 // ModifyVolume handles the ModifyVolume API call
-func ModifyVolume(input *ec2.ModifyVolumeInput, natsConn *nats.Conn) (ec2.ModifyVolumeOutput, error) {
+func ModifyVolume(input *ec2.ModifyVolumeInput, natsConn *nats.Conn, accountID string) (ec2.ModifyVolumeOutput, error) {
 	var output ec2.ModifyVolumeOutput
 
 	err := ValidateModifyVolumeInput(input)
@@ -37,7 +37,7 @@ func ModifyVolume(input *ec2.ModifyVolumeInput, natsConn *nats.Conn) (ec2.Modify
 	}
 
 	volumeService := handlers_ec2_volume.NewNATSVolumeService(natsConn)
-	result, err := volumeService.ModifyVolume(input)
+	result, err := volumeService.ModifyVolume(input, accountID)
 
 	if err != nil {
 		return output, err
diff --git a/hive/gateway/ec2/vpc/CreateNetworkInterface.go b/hive/gateway/ec2/vpc/CreateNetworkInterface.go
index 6a6678042..27fd07258 100644
--- a/hive/gateway/ec2/vpc/CreateNetworkInterface.go
+++ b/hive/gateway/ec2/vpc/CreateNetworkInterface.go
@@ -10,7 +10,7 @@ import (
 )
 
 // CreateNetworkInterface handles the EC2 CreateNetworkInterface API call
-func CreateNetworkInterface(input *ec2.CreateNetworkInterfaceInput, natsConn *nats.Conn) (ec2.CreateNetworkInterfaceOutput, error) {
+func CreateNetworkInterface(input *ec2.CreateNetworkInterfaceInput, natsConn *nats.Conn, accountID string) (ec2.CreateNetworkInterfaceOutput, error) {
 	var output ec2.CreateNetworkInterfaceOutput
 
 	if input == nil {
@@ -21,7 +21,7 @@ func CreateNetworkInterface(input *ec2.CreateNetworkInterfaceInput, natsConn *na
 	}
 
 	svc := handlers_ec2_vpc.NewNATSVPCService(natsConn)
-	result, err := svc.CreateNetworkInterface(input)
+	result, err := svc.CreateNetworkInterface(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/vpc/CreateSubnet.go b/hive/gateway/ec2/vpc/CreateSubnet.go
index e94cbb60e..28626c165 100644
--- a/hive/gateway/ec2/vpc/CreateSubnet.go
+++ b/hive/gateway/ec2/vpc/CreateSubnet.go
@@ -10,7 +10,7 @@ import (
 )
 
 // CreateSubnet handles the EC2 CreateSubnet API call
-func CreateSubnet(input *ec2.CreateSubnetInput, natsConn *nats.Conn) (ec2.CreateSubnetOutput, error) {
+func CreateSubnet(input *ec2.CreateSubnetInput, natsConn *nats.Conn, accountID string) (ec2.CreateSubnetOutput, error) {
 	var output ec2.CreateSubnetOutput
 
 	if input == nil {
@@ -24,7 +24,7 @@ func CreateSubnet(input *ec2.CreateSubnetInput, natsConn *nats.Conn) (ec2.Create
 	}
 
 	svc := handlers_ec2_vpc.NewNATSVPCService(natsConn)
-	result, err := svc.CreateSubnet(input)
+	result, err := svc.CreateSubnet(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/vpc/CreateVpc.go b/hive/gateway/ec2/vpc/CreateVpc.go
index d764e1867..1ebb12ec6 100644
--- a/hive/gateway/ec2/vpc/CreateVpc.go
+++ b/hive/gateway/ec2/vpc/CreateVpc.go
@@ -10,7 +10,7 @@ import (
 )
 
 // CreateVpc handles the EC2 CreateVpc API call
-func CreateVpc(input *ec2.CreateVpcInput, natsConn *nats.Conn) (ec2.CreateVpcOutput, error) {
+func CreateVpc(input *ec2.CreateVpcInput, natsConn *nats.Conn, accountID string) (ec2.CreateVpcOutput, error) {
 	var output ec2.CreateVpcOutput
 
 	if input == nil {
@@ -21,7 +21,7 @@ func CreateVpc(input *ec2.CreateVpcInput, natsConn *nats.Conn) (ec2.CreateVpcOut
 	}
 
 	svc := handlers_ec2_vpc.NewNATSVPCService(natsConn)
-	result, err := svc.CreateVpc(input)
+	result, err := svc.CreateVpc(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/vpc/DeleteNetworkInterface.go b/hive/gateway/ec2/vpc/DeleteNetworkInterface.go
index adadb820f..a0b4d6b8b 100644
--- a/hive/gateway/ec2/vpc/DeleteNetworkInterface.go
+++ b/hive/gateway/ec2/vpc/DeleteNetworkInterface.go
@@ -10,7 +10,7 @@ import (
 )
 
 // DeleteNetworkInterface handles the EC2 DeleteNetworkInterface API call
-func DeleteNetworkInterface(input *ec2.DeleteNetworkInterfaceInput, natsConn *nats.Conn) (ec2.DeleteNetworkInterfaceOutput, error) {
+func DeleteNetworkInterface(input *ec2.DeleteNetworkInterfaceInput, natsConn *nats.Conn, accountID string) (ec2.DeleteNetworkInterfaceOutput, error) {
 	var output ec2.DeleteNetworkInterfaceOutput
 
 	if input == nil {
@@ -21,7 +21,7 @@ func DeleteNetworkInterface(input *ec2.DeleteNetworkInterfaceInput, natsConn *na
 	}
 
 	svc := handlers_ec2_vpc.NewNATSVPCService(natsConn)
-	result, err := svc.DeleteNetworkInterface(input)
+	result, err := svc.DeleteNetworkInterface(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/vpc/DeleteSubnet.go b/hive/gateway/ec2/vpc/DeleteSubnet.go
index d246305f8..9438bd3f8 100644
--- a/hive/gateway/ec2/vpc/DeleteSubnet.go
+++ b/hive/gateway/ec2/vpc/DeleteSubnet.go
@@ -10,7 +10,7 @@ import (
 )
 
 // DeleteSubnet handles the EC2 DeleteSubnet API call
-func DeleteSubnet(input *ec2.DeleteSubnetInput, natsConn *nats.Conn) (ec2.DeleteSubnetOutput, error) {
+func DeleteSubnet(input *ec2.DeleteSubnetInput, natsConn *nats.Conn, accountID string) (ec2.DeleteSubnetOutput, error) {
 	var output ec2.DeleteSubnetOutput
 
 	if input == nil {
@@ -21,7 +21,7 @@ func DeleteSubnet(input *ec2.DeleteSubnetInput, natsConn *nats.Conn) (ec2.Delete
 	}
 
 	svc := handlers_ec2_vpc.NewNATSVPCService(natsConn)
-	result, err := svc.DeleteSubnet(input)
+	result, err := svc.DeleteSubnet(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/vpc/DeleteVpc.go b/hive/gateway/ec2/vpc/DeleteVpc.go
index 2eea8115d..0d8c04560 100644
--- a/hive/gateway/ec2/vpc/DeleteVpc.go
+++ b/hive/gateway/ec2/vpc/DeleteVpc.go
@@ -10,7 +10,7 @@ import (
 )
 
 // DeleteVpc handles the EC2 DeleteVpc API call
-func DeleteVpc(input *ec2.DeleteVpcInput, natsConn *nats.Conn) (ec2.DeleteVpcOutput, error) {
+func DeleteVpc(input *ec2.DeleteVpcInput, natsConn *nats.Conn, accountID string) (ec2.DeleteVpcOutput, error) {
 	var output ec2.DeleteVpcOutput
 
 	if input == nil {
@@ -21,7 +21,7 @@ func DeleteVpc(input *ec2.DeleteVpcInput, natsConn *nats.Conn) (ec2.DeleteVpcOut
 	}
 
 	svc := handlers_ec2_vpc.NewNATSVPCService(natsConn)
-	result, err := svc.DeleteVpc(input)
+	result, err := svc.DeleteVpc(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/vpc/DescribeNetworkInterfaces.go b/hive/gateway/ec2/vpc/DescribeNetworkInterfaces.go
index a736d4df8..3d1cfbf11 100644
--- a/hive/gateway/ec2/vpc/DescribeNetworkInterfaces.go
+++ b/hive/gateway/ec2/vpc/DescribeNetworkInterfaces.go
@@ -7,9 +7,9 @@ import (
 )
 
 // DescribeNetworkInterfaces handles the EC2 DescribeNetworkInterfaces API call
-func DescribeNetworkInterfaces(input *ec2.DescribeNetworkInterfacesInput, natsConn *nats.Conn) (ec2.DescribeNetworkInterfacesOutput, error) {
+func DescribeNetworkInterfaces(input *ec2.DescribeNetworkInterfacesInput, natsConn *nats.Conn, accountID string) (ec2.DescribeNetworkInterfacesOutput, error) {
 	svc := handlers_ec2_vpc.NewNATSVPCService(natsConn)
-	result, err := svc.DescribeNetworkInterfaces(input)
+	result, err := svc.DescribeNetworkInterfaces(input, accountID)
 	if err != nil {
 		return ec2.DescribeNetworkInterfacesOutput{}, err
 	}
diff --git a/hive/gateway/ec2/vpc/DescribeSubnets.go b/hive/gateway/ec2/vpc/DescribeSubnets.go
index ff4f7dec0..2a9b52a27 100644
--- a/hive/gateway/ec2/vpc/DescribeSubnets.go
+++ b/hive/gateway/ec2/vpc/DescribeSubnets.go
@@ -7,11 +7,11 @@ import (
 )
 
 // DescribeSubnets handles the EC2 DescribeSubnets API call
-func DescribeSubnets(input *ec2.DescribeSubnetsInput, natsConn *nats.Conn) (ec2.DescribeSubnetsOutput, error) {
+func DescribeSubnets(input *ec2.DescribeSubnetsInput, natsConn *nats.Conn, accountID string) (ec2.DescribeSubnetsOutput, error) {
 	var output ec2.DescribeSubnetsOutput
 
 	svc := handlers_ec2_vpc.NewNATSVPCService(natsConn)
-	result, err := svc.DescribeSubnets(input)
+	result, err := svc.DescribeSubnets(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/vpc/DescribeVpcs.go b/hive/gateway/ec2/vpc/DescribeVpcs.go
index 31173c906..27b41c74c 100644
--- a/hive/gateway/ec2/vpc/DescribeVpcs.go
+++ b/hive/gateway/ec2/vpc/DescribeVpcs.go
@@ -7,11 +7,11 @@ import (
 )
 
 // DescribeVpcs handles the EC2 DescribeVpcs API call
-func DescribeVpcs(input *ec2.DescribeVpcsInput, natsConn *nats.Conn) (ec2.DescribeVpcsOutput, error) {
+func DescribeVpcs(input *ec2.DescribeVpcsInput, natsConn *nats.Conn, accountID string) (ec2.DescribeVpcsOutput, error) {
 	var output ec2.DescribeVpcsOutput
 
 	svc := handlers_ec2_vpc.NewNATSVPCService(natsConn)
-	result, err := svc.DescribeVpcs(input)
+	result, err := svc.DescribeVpcs(input, accountID)
 	if err != nil {
 		return output, err
 	}
diff --git a/hive/gateway/ec2/vpc/vpc_test.go b/hive/gateway/ec2/vpc/vpc_test.go
index e91a06be1..1aeba362e 100644
--- a/hive/gateway/ec2/vpc/vpc_test.go
+++ b/hive/gateway/ec2/vpc/vpc_test.go
@@ -9,102 +9,104 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+const testAccountID = "123456789012"
+
 func TestCreateVpc_NilInput(t *testing.T) {
-	_, err := CreateVpc(nil, nil)
+	_, err := CreateVpc(nil, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestCreateVpc_NilCidrBlock(t *testing.T) {
-	_, err := CreateVpc(&ec2.CreateVpcInput{}, nil)
+	_, err := CreateVpc(&ec2.CreateVpcInput{}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestCreateVpc_EmptyCidrBlock(t *testing.T) {
-	_, err := CreateVpc(&ec2.CreateVpcInput{CidrBlock: aws.String("")}, nil)
+	_, err := CreateVpc(&ec2.CreateVpcInput{CidrBlock: aws.String("")}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDeleteVpc_NilInput(t *testing.T) {
-	_, err := DeleteVpc(nil, nil)
+	_, err := DeleteVpc(nil, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestDeleteVpc_NilVpcId(t *testing.T) {
-	_, err := DeleteVpc(&ec2.DeleteVpcInput{}, nil)
+	_, err := DeleteVpc(&ec2.DeleteVpcInput{}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDeleteVpc_EmptyVpcId(t *testing.T) {
-	_, err := DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String("")}, nil)
+	_, err := DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String("")}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestCreateSubnet_NilInput(t *testing.T) {
-	_, err := CreateSubnet(nil, nil)
+	_, err := CreateSubnet(nil, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestCreateSubnet_NilVpcId(t *testing.T) {
-	_, err := CreateSubnet(&ec2.CreateSubnetInput{CidrBlock: aws.String("10.0.0.0/24")}, nil)
+	_, err := CreateSubnet(&ec2.CreateSubnetInput{CidrBlock: aws.String("10.0.0.0/24")}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestCreateSubnet_EmptyVpcId(t *testing.T) {
-	_, err := CreateSubnet(&ec2.CreateSubnetInput{VpcId: aws.String(""), CidrBlock: aws.String("10.0.0.0/24")}, nil)
+	_, err := CreateSubnet(&ec2.CreateSubnetInput{VpcId: aws.String(""), CidrBlock: aws.String("10.0.0.0/24")}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestCreateSubnet_NilCidrBlock(t *testing.T) {
-	_, err := CreateSubnet(&ec2.CreateSubnetInput{VpcId: aws.String("vpc-123")}, nil)
+	_, err := CreateSubnet(&ec2.CreateSubnetInput{VpcId: aws.String("vpc-123")}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestCreateSubnet_EmptyCidrBlock(t *testing.T) {
-	_, err := CreateSubnet(&ec2.CreateSubnetInput{VpcId: aws.String("vpc-123"), CidrBlock: aws.String("")}, nil)
+	_, err := CreateSubnet(&ec2.CreateSubnetInput{VpcId: aws.String("vpc-123"), CidrBlock: aws.String("")}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDeleteSubnet_NilInput(t *testing.T) {
-	_, err := DeleteSubnet(nil, nil)
+	_, err := DeleteSubnet(nil, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestDeleteSubnet_NilSubnetId(t *testing.T) {
-	_, err := DeleteSubnet(&ec2.DeleteSubnetInput{}, nil)
+	_, err := DeleteSubnet(&ec2.DeleteSubnetInput{}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDeleteSubnet_EmptySubnetId(t *testing.T) {
-	_, err := DeleteSubnet(&ec2.DeleteSubnetInput{SubnetId: aws.String("")}, nil)
+	_, err := DeleteSubnet(&ec2.DeleteSubnetInput{SubnetId: aws.String("")}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestCreateNetworkInterface_NilInput(t *testing.T) {
-	_, err := CreateNetworkInterface(nil, nil)
+	_, err := CreateNetworkInterface(nil, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestCreateNetworkInterface_NilSubnetId(t *testing.T) {
-	_, err := CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{}, nil)
+	_, err := CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestCreateNetworkInterface_EmptySubnetId(t *testing.T) {
-	_, err := CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{SubnetId: aws.String("")}, nil)
+	_, err := CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{SubnetId: aws.String("")}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDeleteNetworkInterface_NilInput(t *testing.T) {
-	_, err := DeleteNetworkInterface(nil, nil)
+	_, err := DeleteNetworkInterface(nil, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 }
 
 func TestDeleteNetworkInterface_NilNetworkInterfaceId(t *testing.T) {
-	_, err := DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{}, nil)
+	_, err := DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
 
 func TestDeleteNetworkInterface_EmptyNetworkInterfaceId(t *testing.T) {
-	_, err := DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{NetworkInterfaceId: aws.String("")}, nil)
+	_, err := DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{NetworkInterfaceId: aws.String("")}, nil, testAccountID)
 	assert.EqualError(t, err, awserrors.ErrorMissingParameter)
 }
diff --git a/hive/handlers/ec2/account/service.go b/hive/handlers/ec2/account/service.go
index abe281076..ebe15a81d 100644
--- a/hive/handlers/ec2/account/service.go
+++ b/hive/handlers/ec2/account/service.go
@@ -4,10 +4,10 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // AccountSettingsService defines the interface for EC2 account-level settings
 type AccountSettingsService interface {
-	EnableEbsEncryptionByDefault(input *ec2.EnableEbsEncryptionByDefaultInput) (*ec2.EnableEbsEncryptionByDefaultOutput, error)
-	DisableEbsEncryptionByDefault(input *ec2.DisableEbsEncryptionByDefaultInput) (*ec2.DisableEbsEncryptionByDefaultOutput, error)
-	GetEbsEncryptionByDefault(input *ec2.GetEbsEncryptionByDefaultInput) (*ec2.GetEbsEncryptionByDefaultOutput, error)
-	GetSerialConsoleAccessStatus(input *ec2.GetSerialConsoleAccessStatusInput) (*ec2.GetSerialConsoleAccessStatusOutput, error)
-	EnableSerialConsoleAccess(input *ec2.EnableSerialConsoleAccessInput) (*ec2.EnableSerialConsoleAccessOutput, error)
-	DisableSerialConsoleAccess(input *ec2.DisableSerialConsoleAccessInput) (*ec2.DisableSerialConsoleAccessOutput, error)
+	EnableEbsEncryptionByDefault(input *ec2.EnableEbsEncryptionByDefaultInput, accountID string) (*ec2.EnableEbsEncryptionByDefaultOutput, error)
+	DisableEbsEncryptionByDefault(input *ec2.DisableEbsEncryptionByDefaultInput, accountID string) (*ec2.DisableEbsEncryptionByDefaultOutput, error)
+	GetEbsEncryptionByDefault(input *ec2.GetEbsEncryptionByDefaultInput, accountID string) (*ec2.GetEbsEncryptionByDefaultOutput, error)
+	GetSerialConsoleAccessStatus(input *ec2.GetSerialConsoleAccessStatusInput, accountID string) (*ec2.GetSerialConsoleAccessStatusOutput, error)
+	EnableSerialConsoleAccess(input *ec2.EnableSerialConsoleAccessInput, accountID string) (*ec2.EnableSerialConsoleAccessOutput, error)
+	DisableSerialConsoleAccess(input *ec2.DisableSerialConsoleAccessInput, accountID string) (*ec2.DisableSerialConsoleAccessOutput, error)
 }
diff --git a/hive/handlers/ec2/account/service_impl.go b/hive/handlers/ec2/account/service_impl.go
index 46dd58561..9cfca51f4 100644
--- a/hive/handlers/ec2/account/service_impl.go
+++ b/hive/handlers/ec2/account/service_impl.go
@@ -67,9 +67,18 @@ func getOrCreateKVBucket(js nats.JetStreamContext, bucketName string, history in
 	return kv, nil
 }
 
+// settingsKey returns the per-account KV key for storing settings.
+// Falls back to "default" for pre-Phase-4 resources with no accountID.
+func settingsKey(accountID string) string {
+	if accountID == "" {
+		return "default"
+	}
+	return accountID
+}
+
 // getSettings retrieves current account settings
-func (s *AccountSettingsServiceImpl) getSettings() (*AccountSettingsRecord, error) {
-	entry, err := s.settingsKV.Get("default")
+func (s *AccountSettingsServiceImpl) getSettings(accountID string) (*AccountSettingsRecord, error) {
+	entry, err := s.settingsKV.Get(settingsKey(accountID))
 	if err != nil {
 		if errors.Is(err, nats.ErrKeyNotFound) {
 			return &AccountSettingsRecord{
@@ -89,28 +98,28 @@ func (s *AccountSettingsServiceImpl) getSettings() (*AccountSettingsRecord, erro
 }
 
 // saveSettings saves current account settings
-func (s *AccountSettingsServiceImpl) saveSettings(settings *AccountSettingsRecord) error {
+func (s *AccountSettingsServiceImpl) saveSettings(settings *AccountSettingsRecord, accountID string) error {
 	data, err := json.Marshal(settings)
 	if err != nil {
 		return err
 	}
 
-	_, err = s.settingsKV.Put("default", data)
+	_, err = s.settingsKV.Put(settingsKey(accountID), data)
 	return err
 }
 
 // EnableEbsEncryptionByDefault enables EBS encryption by default for the account
-func (s *AccountSettingsServiceImpl) EnableEbsEncryptionByDefault(input *ec2.EnableEbsEncryptionByDefaultInput) (*ec2.EnableEbsEncryptionByDefaultOutput, error) {
-	slog.Info("EnableEbsEncryptionByDefault called")
+func (s *AccountSettingsServiceImpl) EnableEbsEncryptionByDefault(input *ec2.EnableEbsEncryptionByDefaultInput, accountID string) (*ec2.EnableEbsEncryptionByDefaultOutput, error) {
+	slog.Info("EnableEbsEncryptionByDefault called", "accountID", accountID)
 
-	settings, err := s.getSettings()
+	settings, err := s.getSettings(accountID)
 	if err != nil {
 		return nil, err
 	}
 
 	settings.EbsEncryptionByDefault = true
 
-	if err := s.saveSettings(settings); err != nil {
+	if err := s.saveSettings(settings, accountID); err != nil {
 		return nil, err
 	}
 
@@ -120,17 +129,17 @@ func (s *AccountSettingsServiceImpl) EnableEbsEncryptionByDefault(input *ec2.Ena
 }
 
 // DisableEbsEncryptionByDefault disables EBS encryption by default for the account
-func (s *AccountSettingsServiceImpl) DisableEbsEncryptionByDefault(input *ec2.DisableEbsEncryptionByDefaultInput) (*ec2.DisableEbsEncryptionByDefaultOutput, error) {
-	slog.Info("DisableEbsEncryptionByDefault called")
+func (s *AccountSettingsServiceImpl) DisableEbsEncryptionByDefault(input *ec2.DisableEbsEncryptionByDefaultInput, accountID string) (*ec2.DisableEbsEncryptionByDefaultOutput, error) {
+	slog.Info("DisableEbsEncryptionByDefault called", "accountID", accountID)
 
-	settings, err := s.getSettings()
+	settings, err := s.getSettings(accountID)
 	if err != nil {
 		return nil, err
 	}
 
 	settings.EbsEncryptionByDefault = false
 
-	if err := s.saveSettings(settings); err != nil {
+	if err := s.saveSettings(settings, accountID); err != nil {
 		return nil, err
 	}
 
@@ -140,10 +149,10 @@ func (s *AccountSettingsServiceImpl) DisableEbsEncryptionByDefault(input *ec2.Di
 }
 
 // GetEbsEncryptionByDefault gets the current EBS encryption by default setting
-func (s *AccountSettingsServiceImpl) GetEbsEncryptionByDefault(input *ec2.GetEbsEncryptionByDefaultInput) (*ec2.GetEbsEncryptionByDefaultOutput, error) {
-	slog.Info("GetEbsEncryptionByDefault called")
+func (s *AccountSettingsServiceImpl) GetEbsEncryptionByDefault(input *ec2.GetEbsEncryptionByDefaultInput, accountID string) (*ec2.GetEbsEncryptionByDefaultOutput, error) {
+	slog.Info("GetEbsEncryptionByDefault called", "accountID", accountID)
 
-	settings, err := s.getSettings()
+	settings, err := s.getSettings(accountID)
 	if err != nil {
 		return nil, err
 	}
@@ -154,10 +163,10 @@ func (s *AccountSettingsServiceImpl) GetEbsEncryptionByDefault(input *ec2.GetEbs
 }
 
 // GetSerialConsoleAccessStatus gets the current serial console access status
-func (s *AccountSettingsServiceImpl) GetSerialConsoleAccessStatus(input *ec2.GetSerialConsoleAccessStatusInput) (*ec2.GetSerialConsoleAccessStatusOutput, error) {
-	slog.Info("GetSerialConsoleAccessStatus called")
+func (s *AccountSettingsServiceImpl) GetSerialConsoleAccessStatus(input *ec2.GetSerialConsoleAccessStatusInput, accountID string) (*ec2.GetSerialConsoleAccessStatusOutput, error) {
+	slog.Info("GetSerialConsoleAccessStatus called", "accountID", accountID)
 
-	settings, err := s.getSettings()
+	settings, err := s.getSettings(accountID)
 	if err != nil {
 		return nil, err
 	}
@@ -168,17 +177,17 @@ func (s *AccountSettingsServiceImpl) GetSerialConsoleAccessStatus(input *ec2.Get
 }
 
 // EnableSerialConsoleAccess enables serial console access for the account
-func (s *AccountSettingsServiceImpl) EnableSerialConsoleAccess(input *ec2.EnableSerialConsoleAccessInput) (*ec2.EnableSerialConsoleAccessOutput, error) {
-	slog.Info("EnableSerialConsoleAccess called")
+func (s *AccountSettingsServiceImpl) EnableSerialConsoleAccess(input *ec2.EnableSerialConsoleAccessInput, accountID string) (*ec2.EnableSerialConsoleAccessOutput, error) {
+	slog.Info("EnableSerialConsoleAccess called", "accountID", accountID)
 
-	settings, err := s.getSettings()
+	settings, err := s.getSettings(accountID)
 	if err != nil {
 		return nil, err
 	}
 
 	settings.SerialConsoleAccess = true
 
-	if err := s.saveSettings(settings); err != nil {
+	if err := s.saveSettings(settings, accountID); err != nil {
 		return nil, err
 	}
 
@@ -188,17 +197,17 @@ func (s *AccountSettingsServiceImpl) EnableSerialConsoleAccess(input *ec2.Enable
 }
 
 // DisableSerialConsoleAccess disables serial console access for the account
-func (s *AccountSettingsServiceImpl) DisableSerialConsoleAccess(input *ec2.DisableSerialConsoleAccessInput) (*ec2.DisableSerialConsoleAccessOutput, error) {
-	slog.Info("DisableSerialConsoleAccess called")
+func (s *AccountSettingsServiceImpl) DisableSerialConsoleAccess(input *ec2.DisableSerialConsoleAccessInput, accountID string) (*ec2.DisableSerialConsoleAccessOutput, error) {
+	slog.Info("DisableSerialConsoleAccess called", "accountID", accountID)
 
-	settings, err := s.getSettings()
+	settings, err := s.getSettings(accountID)
 	if err != nil {
 		return nil, err
 	}
 
 	settings.SerialConsoleAccess = false
 
-	if err := s.saveSettings(settings); err != nil {
+	if err := s.saveSettings(settings, accountID); err != nil {
 		return nil, err
 	}
 
diff --git a/hive/handlers/ec2/account/service_impl_test.go b/hive/handlers/ec2/account/service_impl_test.go
index b56a880a6..c73b1b90e 100644
--- a/hive/handlers/ec2/account/service_impl_test.go
+++ b/hive/handlers/ec2/account/service_impl_test.go
@@ -62,11 +62,13 @@ func setupTestAccountService(t *testing.T) *AccountSettingsServiceImpl {
 	return svc
 }
 
+const testAccountID = "111111111111"
+
 // EBS Encryption tests
 
 func TestEbsEncryption_DefaultOff(t *testing.T) {
 	svc := setupTestAccountService(t)
-	out, err := svc.GetEbsEncryptionByDefault(&ec2.GetEbsEncryptionByDefaultInput{})
+	out, err := svc.GetEbsEncryptionByDefault(&ec2.GetEbsEncryptionByDefaultInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.False(t, *out.EbsEncryptionByDefault)
 }
@@ -75,22 +77,22 @@ func TestEbsEncryption_EnableDisable(t *testing.T) {
 	svc := setupTestAccountService(t)
 
 	// Enable
-	enableOut, err := svc.EnableEbsEncryptionByDefault(&ec2.EnableEbsEncryptionByDefaultInput{})
+	enableOut, err := svc.EnableEbsEncryptionByDefault(&ec2.EnableEbsEncryptionByDefaultInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.True(t, *enableOut.EbsEncryptionByDefault)
 
 	// Verify
-	getOut, err := svc.GetEbsEncryptionByDefault(&ec2.GetEbsEncryptionByDefaultInput{})
+	getOut, err := svc.GetEbsEncryptionByDefault(&ec2.GetEbsEncryptionByDefaultInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.True(t, *getOut.EbsEncryptionByDefault)
 
 	// Disable
-	disableOut, err := svc.DisableEbsEncryptionByDefault(&ec2.DisableEbsEncryptionByDefaultInput{})
+	disableOut, err := svc.DisableEbsEncryptionByDefault(&ec2.DisableEbsEncryptionByDefaultInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.False(t, *disableOut.EbsEncryptionByDefault)
 
 	// Verify
-	getOut, err = svc.GetEbsEncryptionByDefault(&ec2.GetEbsEncryptionByDefaultInput{})
+	getOut, err = svc.GetEbsEncryptionByDefault(&ec2.GetEbsEncryptionByDefaultInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.False(t, *getOut.EbsEncryptionByDefault)
 }
@@ -99,7 +101,7 @@ func TestEbsEncryption_EnableDisable(t *testing.T) {
 
 func TestSerialConsole_DefaultOff(t *testing.T) {
 	svc := setupTestAccountService(t)
-	out, err := svc.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{})
+	out, err := svc.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.False(t, *out.SerialConsoleAccessEnabled)
 }
@@ -107,19 +109,66 @@ func TestSerialConsole_DefaultOff(t *testing.T) {
 func TestSerialConsole_EnableDisable(t *testing.T) {
 	svc := setupTestAccountService(t)
 
-	enableOut, err := svc.EnableSerialConsoleAccess(&ec2.EnableSerialConsoleAccessInput{})
+	enableOut, err := svc.EnableSerialConsoleAccess(&ec2.EnableSerialConsoleAccessInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.True(t, *enableOut.SerialConsoleAccessEnabled)
 
-	getOut, err := svc.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{})
+	getOut, err := svc.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.True(t, *getOut.SerialConsoleAccessEnabled)
 
-	disableOut, err := svc.DisableSerialConsoleAccess(&ec2.DisableSerialConsoleAccessInput{})
+	disableOut, err := svc.DisableSerialConsoleAccess(&ec2.DisableSerialConsoleAccessInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.False(t, *disableOut.SerialConsoleAccessEnabled)
 
-	getOut, err = svc.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{})
+	getOut, err = svc.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.False(t, *getOut.SerialConsoleAccessEnabled)
 }
+
+// Multi-account isolation tests
+
+func TestEbsEncryption_MultiAccountIsolation(t *testing.T) {
+	svc := setupTestAccountService(t)
+	accountA := "111111111111"
+	accountB := "222222222222"
+
+	// Enable EBS encryption for account A only
+	_, err := svc.EnableEbsEncryptionByDefault(&ec2.EnableEbsEncryptionByDefaultInput{}, accountA)
+	require.NoError(t, err)
+
+	// Account A should have encryption enabled
+	outA, err := svc.GetEbsEncryptionByDefault(&ec2.GetEbsEncryptionByDefaultInput{}, accountA)
+	require.NoError(t, err)
+	assert.True(t, *outA.EbsEncryptionByDefault)
+
+	// Account B should still have encryption disabled (default)
+	outB, err := svc.GetEbsEncryptionByDefault(&ec2.GetEbsEncryptionByDefaultInput{}, accountB)
+	require.NoError(t, err)
+	assert.False(t, *outB.EbsEncryptionByDefault)
+}
+
+func TestSerialConsole_MultiAccountIsolation(t *testing.T) {
+	svc := setupTestAccountService(t)
+	accountA := "111111111111"
+	accountB := "222222222222"
+
+	// Enable serial console for account A only
+	_, err := svc.EnableSerialConsoleAccess(&ec2.EnableSerialConsoleAccessInput{}, accountA)
+	require.NoError(t, err)
+
+	// Account A should have serial console enabled
+	outA, err := svc.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{}, accountA)
+	require.NoError(t, err)
+	assert.True(t, *outA.SerialConsoleAccessEnabled)
+
+	// Account B should still have serial console disabled (default)
+	outB, err := svc.GetSerialConsoleAccessStatus(&ec2.GetSerialConsoleAccessStatusInput{}, accountB)
+	require.NoError(t, err)
+	assert.False(t, *outB.SerialConsoleAccessEnabled)
+}
+
+func TestSettingsKey_EmptyAccountIDFallback(t *testing.T) {
+	assert.Equal(t, "default", settingsKey(""))
+	assert.Equal(t, "123456789012", settingsKey("123456789012"))
+}
diff --git a/hive/handlers/ec2/account/service_nats.go b/hive/handlers/ec2/account/service_nats.go
index 623ded33e..082502467 100644
--- a/hive/handlers/ec2/account/service_nats.go
+++ b/hive/handlers/ec2/account/service_nats.go
@@ -18,26 +18,26 @@ func NewNATSAccountSettingsService(natsConn *nats.Conn) AccountSettingsService {
 	return &NATSAccountSettingsService{natsConn: natsConn}
 }
 
-func (s *NATSAccountSettingsService) EnableEbsEncryptionByDefault(input *ec2.EnableEbsEncryptionByDefaultInput) (*ec2.EnableEbsEncryptionByDefaultOutput, error) {
-	return utils.NATSRequest[ec2.EnableEbsEncryptionByDefaultOutput](s.natsConn, "ec2.EnableEbsEncryptionByDefault", input, 30*time.Second)
+func (s *NATSAccountSettingsService) EnableEbsEncryptionByDefault(input *ec2.EnableEbsEncryptionByDefaultInput, accountID string) (*ec2.EnableEbsEncryptionByDefaultOutput, error) {
+	return utils.NATSRequest[ec2.EnableEbsEncryptionByDefaultOutput](s.natsConn, "ec2.EnableEbsEncryptionByDefault", input, 30*time.Second, accountID)
 }
 
-func (s *NATSAccountSettingsService) DisableEbsEncryptionByDefault(input *ec2.DisableEbsEncryptionByDefaultInput) (*ec2.DisableEbsEncryptionByDefaultOutput, error) {
-	return utils.NATSRequest[ec2.DisableEbsEncryptionByDefaultOutput](s.natsConn, "ec2.DisableEbsEncryptionByDefault", input, 30*time.Second)
+func (s *NATSAccountSettingsService) DisableEbsEncryptionByDefault(input *ec2.DisableEbsEncryptionByDefaultInput, accountID string) (*ec2.DisableEbsEncryptionByDefaultOutput, error) {
+	return utils.NATSRequest[ec2.DisableEbsEncryptionByDefaultOutput](s.natsConn, "ec2.DisableEbsEncryptionByDefault", input, 30*time.Second, accountID)
 }
 
-func (s *NATSAccountSettingsService) GetEbsEncryptionByDefault(input *ec2.GetEbsEncryptionByDefaultInput) (*ec2.GetEbsEncryptionByDefaultOutput, error) {
-	return utils.NATSRequest[ec2.GetEbsEncryptionByDefaultOutput](s.natsConn, "ec2.GetEbsEncryptionByDefault", input, 30*time.Second)
+func (s *NATSAccountSettingsService) GetEbsEncryptionByDefault(input *ec2.GetEbsEncryptionByDefaultInput, accountID string) (*ec2.GetEbsEncryptionByDefaultOutput, error) {
+	return utils.NATSRequest[ec2.GetEbsEncryptionByDefaultOutput](s.natsConn, "ec2.GetEbsEncryptionByDefault", input, 30*time.Second, accountID)
 }
 
-func (s *NATSAccountSettingsService) GetSerialConsoleAccessStatus(input *ec2.GetSerialConsoleAccessStatusInput) (*ec2.GetSerialConsoleAccessStatusOutput, error) {
-	return utils.NATSRequest[ec2.GetSerialConsoleAccessStatusOutput](s.natsConn, "ec2.GetSerialConsoleAccessStatus", input, 30*time.Second)
+func (s *NATSAccountSettingsService) GetSerialConsoleAccessStatus(input *ec2.GetSerialConsoleAccessStatusInput, accountID string) (*ec2.GetSerialConsoleAccessStatusOutput, error) {
+	return utils.NATSRequest[ec2.GetSerialConsoleAccessStatusOutput](s.natsConn, "ec2.GetSerialConsoleAccessStatus", input, 30*time.Second, accountID)
 }
 
-func (s *NATSAccountSettingsService) EnableSerialConsoleAccess(input *ec2.EnableSerialConsoleAccessInput) (*ec2.EnableSerialConsoleAccessOutput, error) {
-	return utils.NATSRequest[ec2.EnableSerialConsoleAccessOutput](s.natsConn, "ec2.EnableSerialConsoleAccess", input, 30*time.Second)
+func (s *NATSAccountSettingsService) EnableSerialConsoleAccess(input *ec2.EnableSerialConsoleAccessInput, accountID string) (*ec2.EnableSerialConsoleAccessOutput, error) {
+	return utils.NATSRequest[ec2.EnableSerialConsoleAccessOutput](s.natsConn, "ec2.EnableSerialConsoleAccess", input, 30*time.Second, accountID)
 }
 
-func (s *NATSAccountSettingsService) DisableSerialConsoleAccess(input *ec2.DisableSerialConsoleAccessInput) (*ec2.DisableSerialConsoleAccessOutput, error) {
-	return utils.NATSRequest[ec2.DisableSerialConsoleAccessOutput](s.natsConn, "ec2.DisableSerialConsoleAccess", input, 30*time.Second)
+func (s *NATSAccountSettingsService) DisableSerialConsoleAccess(input *ec2.DisableSerialConsoleAccessInput, accountID string) (*ec2.DisableSerialConsoleAccessOutput, error) {
+	return utils.NATSRequest[ec2.DisableSerialConsoleAccessOutput](s.natsConn, "ec2.DisableSerialConsoleAccess", input, 30*time.Second, accountID)
 }
diff --git a/hive/handlers/ec2/eigw/service.go b/hive/handlers/ec2/eigw/service.go
index 67e8e0c58..da8eff17a 100644
--- a/hive/handlers/ec2/eigw/service.go
+++ b/hive/handlers/ec2/eigw/service.go
@@ -4,7 +4,7 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // EgressOnlyIGWService defines the interface for Egress-only Internet Gateway operations
 type EgressOnlyIGWService interface {
-	CreateEgressOnlyInternetGateway(input *ec2.CreateEgressOnlyInternetGatewayInput) (*ec2.CreateEgressOnlyInternetGatewayOutput, error)
-	DeleteEgressOnlyInternetGateway(input *ec2.DeleteEgressOnlyInternetGatewayInput) (*ec2.DeleteEgressOnlyInternetGatewayOutput, error)
-	DescribeEgressOnlyInternetGateways(input *ec2.DescribeEgressOnlyInternetGatewaysInput) (*ec2.DescribeEgressOnlyInternetGatewaysOutput, error)
+	CreateEgressOnlyInternetGateway(input *ec2.CreateEgressOnlyInternetGatewayInput, accountID string) (*ec2.CreateEgressOnlyInternetGatewayOutput, error)
+	DeleteEgressOnlyInternetGateway(input *ec2.DeleteEgressOnlyInternetGatewayInput, accountID string) (*ec2.DeleteEgressOnlyInternetGatewayOutput, error)
+	DescribeEgressOnlyInternetGateways(input *ec2.DescribeEgressOnlyInternetGatewaysInput, accountID string) (*ec2.DescribeEgressOnlyInternetGatewaysOutput, error)
 }
diff --git a/hive/handlers/ec2/eigw/service_impl.go b/hive/handlers/ec2/eigw/service_impl.go
index b704e7a9a..c5601f1f2 100644
--- a/hive/handlers/ec2/eigw/service_impl.go
+++ b/hive/handlers/ec2/eigw/service_impl.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -19,6 +20,7 @@ import (
 var _ EgressOnlyIGWService = (*EgressOnlyIGWServiceImpl)(nil)
 
 const KVBucketEgressOnlyIGW = "hive-eigw"
+const kvBucketVPCs = "hive-vpc-vpcs"
 
 // EgressOnlyIGWRecord represents a stored Egress-only Internet Gateway
 type EgressOnlyIGWRecord struct {
@@ -33,6 +35,7 @@ type EgressOnlyIGWRecord struct {
 type EgressOnlyIGWServiceImpl struct {
 	config *config.Config
 	eigwKV nats.KeyValue
+	vpcKV  nats.KeyValue
 }
 
 // NewEgressOnlyIGWServiceImpl creates a new Egress-only Internet Gateway service implementation
@@ -54,11 +57,18 @@ func NewEgressOnlyIGWServiceImplWithNATS(cfg *config.Config, natsConn *nats.Conn
 		return nil, fmt.Errorf("failed to create KV bucket %s: %w", KVBucketEgressOnlyIGW, err)
 	}
 
+	// Get VPC KV bucket for cross-resource ownership validation
+	vpcKV, err := js.KeyValue(kvBucketVPCs)
+	if err != nil {
+		slog.Warn("EIGW service: VPC KV bucket not available, VPC ownership checks disabled", "error", err)
+	}
+
 	slog.Info("Egress-only IGW service initialized with JetStream KV", "bucket", KVBucketEgressOnlyIGW)
 
 	return &EgressOnlyIGWServiceImpl{
 		config: cfg,
 		eigwKV: eigwKV,
+		vpcKV:  vpcKV,
 	}, nil
 }
 
@@ -76,12 +86,24 @@ func getOrCreateKVBucket(js nats.JetStreamContext, bucketName string, history in
 	return kv, nil
 }
 
+func accountKey(accountID, resourceID string) string {
+	return accountID + "." + resourceID
+}
+
 // CreateEgressOnlyInternetGateway creates a new Egress-only Internet Gateway
-func (s *EgressOnlyIGWServiceImpl) CreateEgressOnlyInternetGateway(input *ec2.CreateEgressOnlyInternetGatewayInput) (*ec2.CreateEgressOnlyInternetGatewayOutput, error) {
+func (s *EgressOnlyIGWServiceImpl) CreateEgressOnlyInternetGateway(input *ec2.CreateEgressOnlyInternetGatewayInput, accountID string) (*ec2.CreateEgressOnlyInternetGatewayOutput, error) {
 	if input.VpcId == nil || *input.VpcId == "" {
 		return nil, errors.New(awserrors.ErrorMissingParameter)
 	}
 
+	// Verify the caller owns the target VPC
+	if s.vpcKV != nil {
+		if _, err := s.vpcKV.Get(accountKey(accountID, *input.VpcId)); err != nil {
+			slog.Warn("CreateEgressOnlyInternetGateway: VPC not found for account", "vpcId", *input.VpcId, "accountID", accountID)
+			return nil, errors.New(awserrors.ErrorInvalidVpcIDNotFound)
+		}
+	}
+
 	eigwID := utils.GenerateResourceID("eigw")
 
 	record := EgressOnlyIGWRecord{
@@ -106,11 +128,11 @@ func (s *EgressOnlyIGWServiceImpl) CreateEgressOnlyInternetGateway(input *ec2.Cr
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal Egress-only IGW record: %w", err)
 	}
-	if _, err := s.eigwKV.Put(eigwID, data); err != nil {
+	if _, err := s.eigwKV.Put(accountKey(accountID, eigwID), data); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("CreateEgressOnlyInternetGateway completed", "egressOnlyInternetGatewayId", eigwID, "vpcId", record.VpcId)
+	slog.Info("CreateEgressOnlyInternetGateway completed", "egressOnlyInternetGatewayId", eigwID, "vpcId", record.VpcId, "accountID", accountID)
 
 	return &ec2.CreateEgressOnlyInternetGatewayOutput{
 		EgressOnlyInternetGateway: s.recordToEC2(&record),
@@ -118,22 +140,23 @@ func (s *EgressOnlyIGWServiceImpl) CreateEgressOnlyInternetGateway(input *ec2.Cr
 }
 
 // DeleteEgressOnlyInternetGateway deletes an Egress-only Internet Gateway
-func (s *EgressOnlyIGWServiceImpl) DeleteEgressOnlyInternetGateway(input *ec2.DeleteEgressOnlyInternetGatewayInput) (*ec2.DeleteEgressOnlyInternetGatewayOutput, error) {
+func (s *EgressOnlyIGWServiceImpl) DeleteEgressOnlyInternetGateway(input *ec2.DeleteEgressOnlyInternetGatewayInput, accountID string) (*ec2.DeleteEgressOnlyInternetGatewayOutput, error) {
 	if input.EgressOnlyInternetGatewayId == nil || *input.EgressOnlyInternetGatewayId == "" {
 		return nil, errors.New(awserrors.ErrorMissingParameter)
 	}
 
 	eigwID := *input.EgressOnlyInternetGatewayId
+	key := accountKey(accountID, eigwID)
 
-	if _, err := s.eigwKV.Get(eigwID); err != nil {
+	if _, err := s.eigwKV.Get(key); err != nil {
 		return nil, errors.New(awserrors.ErrorInvalidEgressOnlyInternetGatewayIdNotFound)
 	}
 
-	if err := s.eigwKV.Delete(eigwID); err != nil {
+	if err := s.eigwKV.Delete(key); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("DeleteEgressOnlyInternetGateway completed", "egressOnlyInternetGatewayId", eigwID)
+	slog.Info("DeleteEgressOnlyInternetGateway completed", "egressOnlyInternetGatewayId", eigwID, "accountID", accountID)
 
 	return &ec2.DeleteEgressOnlyInternetGatewayOutput{
 		ReturnCode: aws.Bool(true),
@@ -141,7 +164,7 @@ func (s *EgressOnlyIGWServiceImpl) DeleteEgressOnlyInternetGateway(input *ec2.De
 }
 
 // DescribeEgressOnlyInternetGateways describes Egress-only Internet Gateways
-func (s *EgressOnlyIGWServiceImpl) DescribeEgressOnlyInternetGateways(input *ec2.DescribeEgressOnlyInternetGatewaysInput) (*ec2.DescribeEgressOnlyInternetGatewaysOutput, error) {
+func (s *EgressOnlyIGWServiceImpl) DescribeEgressOnlyInternetGateways(input *ec2.DescribeEgressOnlyInternetGatewaysInput, accountID string) (*ec2.DescribeEgressOnlyInternetGatewaysOutput, error) {
 	var egressOnlyIGWs []*ec2.EgressOnlyInternetGateway
 
 	eigwIDs := make(map[string]bool)
@@ -151,13 +174,14 @@ func (s *EgressOnlyIGWServiceImpl) DescribeEgressOnlyInternetGateways(input *ec2
 		}
 	}
 
+	prefix := accountID + "."
 	keys, err := s.eigwKV.Keys()
 	if err != nil && !errors.Is(err, nats.ErrNoKeysFound) {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
 	for _, key := range keys {
-		if len(eigwIDs) > 0 && !eigwIDs[key] {
+		if !strings.HasPrefix(key, prefix) {
 			continue
 		}
 
@@ -173,10 +197,14 @@ func (s *EgressOnlyIGWServiceImpl) DescribeEgressOnlyInternetGateways(input *ec2
 			continue
 		}
 
+		if len(eigwIDs) > 0 && !eigwIDs[record.EgressOnlyInternetGatewayId] {
+			continue
+		}
+
 		egressOnlyIGWs = append(egressOnlyIGWs, s.recordToEC2(&record))
 	}
 
-	slog.Info("DescribeEgressOnlyInternetGateways completed", "count", len(egressOnlyIGWs))
+	slog.Info("DescribeEgressOnlyInternetGateways completed", "count", len(egressOnlyIGWs), "accountID", accountID)
 
 	return &ec2.DescribeEgressOnlyInternetGatewaysOutput{
 		EgressOnlyInternetGateways: egressOnlyIGWs,
diff --git a/hive/handlers/ec2/eigw/service_impl_test.go b/hive/handlers/ec2/eigw/service_impl_test.go
index 216fc40b4..df3d7030b 100644
--- a/hive/handlers/ec2/eigw/service_impl_test.go
+++ b/hive/handlers/ec2/eigw/service_impl_test.go
@@ -12,6 +12,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+const testAccountID = "123456789012"
+
 func setupTestEIGWService(t *testing.T) *EgressOnlyIGWServiceImpl {
 	t.Helper()
 	opts := &server.Options{
@@ -41,7 +43,7 @@ func createTestEIGW(t *testing.T, svc *EgressOnlyIGWServiceImpl) string {
 	t.Helper()
 	out, err := svc.CreateEgressOnlyInternetGateway(&ec2.CreateEgressOnlyInternetGatewayInput{
 		VpcId: aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	return *out.EgressOnlyInternetGateway.EgressOnlyInternetGatewayId
 }
@@ -50,7 +52,7 @@ func TestCreateEgressOnlyInternetGateway(t *testing.T) {
 	svc := setupTestEIGWService(t)
 	out, err := svc.CreateEgressOnlyInternetGateway(&ec2.CreateEgressOnlyInternetGatewayInput{
 		VpcId: aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out.EgressOnlyInternetGateway)
 	assert.Equal(t, "eigw-", (*out.EgressOnlyInternetGateway.EgressOnlyInternetGatewayId)[:5])
@@ -61,7 +63,7 @@ func TestCreateEgressOnlyInternetGateway(t *testing.T) {
 
 func TestCreateEgressOnlyInternetGateway_MissingVpcId(t *testing.T) {
 	svc := setupTestEIGWService(t)
-	_, err := svc.CreateEgressOnlyInternetGateway(&ec2.CreateEgressOnlyInternetGatewayInput{})
+	_, err := svc.CreateEgressOnlyInternetGateway(&ec2.CreateEgressOnlyInternetGatewayInput{}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -69,7 +71,7 @@ func TestCreateEgressOnlyInternetGateway_EmptyVpcId(t *testing.T) {
 	svc := setupTestEIGWService(t)
 	_, err := svc.CreateEgressOnlyInternetGateway(&ec2.CreateEgressOnlyInternetGatewayInput{
 		VpcId: aws.String(""),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -86,7 +88,7 @@ func TestCreateEgressOnlyInternetGateway_WithTags(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out.EgressOnlyInternetGateway)
 	assert.Len(t, out.EgressOnlyInternetGateway.Tags, 2)
@@ -94,7 +96,7 @@ func TestCreateEgressOnlyInternetGateway_WithTags(t *testing.T) {
 	// Verify tags persist through describe
 	desc, err := svc.DescribeEgressOnlyInternetGateways(&ec2.DescribeEgressOnlyInternetGatewaysInput{
 		EgressOnlyInternetGatewayIds: []*string{out.EgressOnlyInternetGateway.EgressOnlyInternetGatewayId},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.EgressOnlyInternetGateways, 1)
 	assert.Len(t, desc.EgressOnlyInternetGateways[0].Tags, 2)
@@ -112,7 +114,7 @@ func TestCreateEgressOnlyInternetGateway_TagsWrongResourceType(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, out.EgressOnlyInternetGateway.Tags)
 }
@@ -123,13 +125,13 @@ func TestDeleteEgressOnlyInternetGateway(t *testing.T) {
 
 	out, err := svc.DeleteEgressOnlyInternetGateway(&ec2.DeleteEgressOnlyInternetGatewayInput{
 		EgressOnlyInternetGatewayId: aws.String(eigwID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.True(t, *out.ReturnCode)
 
 	desc, err := svc.DescribeEgressOnlyInternetGateways(&ec2.DescribeEgressOnlyInternetGatewaysInput{
 		EgressOnlyInternetGatewayIds: []*string{aws.String(eigwID)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, desc.EgressOnlyInternetGateways)
 }
@@ -138,13 +140,13 @@ func TestDeleteEgressOnlyInternetGateway_NotFound(t *testing.T) {
 	svc := setupTestEIGWService(t)
 	_, err := svc.DeleteEgressOnlyInternetGateway(&ec2.DeleteEgressOnlyInternetGatewayInput{
 		EgressOnlyInternetGatewayId: aws.String("eigw-nonexistent"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidEgressOnlyInternetGatewayId.NotFound")
 }
 
 func TestDeleteEgressOnlyInternetGateway_MissingID(t *testing.T) {
 	svc := setupTestEIGWService(t)
-	_, err := svc.DeleteEgressOnlyInternetGateway(&ec2.DeleteEgressOnlyInternetGatewayInput{})
+	_, err := svc.DeleteEgressOnlyInternetGateway(&ec2.DeleteEgressOnlyInternetGatewayInput{}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -152,7 +154,7 @@ func TestDeleteEgressOnlyInternetGateway_EmptyID(t *testing.T) {
 	svc := setupTestEIGWService(t)
 	_, err := svc.DeleteEgressOnlyInternetGateway(&ec2.DeleteEgressOnlyInternetGatewayInput{
 		EgressOnlyInternetGatewayId: aws.String(""),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -161,7 +163,7 @@ func TestDescribeEgressOnlyInternetGateways_All(t *testing.T) {
 	createTestEIGW(t, svc)
 	createTestEIGW(t, svc)
 
-	desc, err := svc.DescribeEgressOnlyInternetGateways(&ec2.DescribeEgressOnlyInternetGatewaysInput{})
+	desc, err := svc.DescribeEgressOnlyInternetGateways(&ec2.DescribeEgressOnlyInternetGatewaysInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, desc.EgressOnlyInternetGateways, 2)
 }
@@ -172,7 +174,7 @@ func TestDescribeEgressOnlyInternetGateways_ByID(t *testing.T) {
 
 	desc, err := svc.DescribeEgressOnlyInternetGateways(&ec2.DescribeEgressOnlyInternetGatewaysInput{
 		EgressOnlyInternetGatewayIds: []*string{aws.String(eigwID)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.EgressOnlyInternetGateways, 1)
 	assert.Equal(t, eigwID, *desc.EgressOnlyInternetGateways[0].EgressOnlyInternetGatewayId)
@@ -180,7 +182,58 @@ func TestDescribeEgressOnlyInternetGateways_ByID(t *testing.T) {
 
 func TestDescribeEgressOnlyInternetGateways_Empty(t *testing.T) {
 	svc := setupTestEIGWService(t)
-	desc, err := svc.DescribeEgressOnlyInternetGateways(&ec2.DescribeEgressOnlyInternetGatewaysInput{})
+	desc, err := svc.DescribeEgressOnlyInternetGateways(&ec2.DescribeEgressOnlyInternetGatewaysInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, desc.EgressOnlyInternetGateways)
 }
+
+// TestCreateEgressOnlyInternetGateway_CrossAccountVPCRejected tests that creating an EIGW in another account's VPC is rejected.
+func TestCreateEgressOnlyInternetGateway_CrossAccountVPCRejected(t *testing.T) {
+	// Set up with manual NATS to get VPC KV access
+	opts := &server.Options{
+		Host:      "127.0.0.1",
+		Port:      -1,
+		JetStream: true,
+		StoreDir:  t.TempDir(),
+		NoLog:     true,
+		NoSigs:    true,
+	}
+	ns, err := server.NewServer(opts)
+	require.NoError(t, err)
+	go ns.Start()
+	require.True(t, ns.ReadyForConnections(5*time.Second))
+	t.Cleanup(func() { ns.Shutdown() })
+
+	nc, err := nats.Connect(ns.ClientURL())
+	require.NoError(t, err)
+	t.Cleanup(func() { nc.Close() })
+
+	// Create VPC KV bucket with a VPC owned by testAccountID
+	js, err := nc.JetStream()
+	require.NoError(t, err)
+	vpcKV, err := js.CreateKeyValue(&nats.KeyValueConfig{Bucket: kvBucketVPCs, History: 1})
+	require.NoError(t, err)
+
+	vpcID := "vpc-alpha456"
+	_, err = vpcKV.Put(accountKey(testAccountID, vpcID), []byte(`{"vpc_id":"vpc-alpha456","state":"available"}`))
+	require.NoError(t, err)
+
+	// Create EIGW service (VPC KV will be populated since we created it before EIGW init)
+	svc, err := NewEgressOnlyIGWServiceImplWithNATS(nil, nc)
+	require.NoError(t, err)
+
+	// Other account tries to create EIGW in testAccountID's VPC — should fail
+	otherAccount := "999999999999"
+	_, err = svc.CreateEgressOnlyInternetGateway(&ec2.CreateEgressOnlyInternetGatewayInput{
+		VpcId: aws.String(vpcID),
+	}, otherAccount)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "InvalidVpcID.NotFound")
+
+	// Owner creates EIGW in their own VPC — should succeed
+	out, err := svc.CreateEgressOnlyInternetGateway(&ec2.CreateEgressOnlyInternetGatewayInput{
+		VpcId: aws.String(vpcID),
+	}, testAccountID)
+	require.NoError(t, err)
+	assert.NotNil(t, out.EgressOnlyInternetGateway)
+}
diff --git a/hive/handlers/ec2/eigw/service_nats.go b/hive/handlers/ec2/eigw/service_nats.go
index 3cca6877e..d9020d712 100644
--- a/hive/handlers/ec2/eigw/service_nats.go
+++ b/hive/handlers/ec2/eigw/service_nats.go
@@ -18,14 +18,14 @@ func NewNATSEgressOnlyIGWService(conn *nats.Conn) EgressOnlyIGWService {
 	return &NATSEgressOnlyIGWService{natsConn: conn}
 }
 
-func (s *NATSEgressOnlyIGWService) CreateEgressOnlyInternetGateway(input *ec2.CreateEgressOnlyInternetGatewayInput) (*ec2.CreateEgressOnlyInternetGatewayOutput, error) {
-	return utils.NATSRequest[ec2.CreateEgressOnlyInternetGatewayOutput](s.natsConn, "ec2.CreateEgressOnlyInternetGateway", input, 30*time.Second)
+func (s *NATSEgressOnlyIGWService) CreateEgressOnlyInternetGateway(input *ec2.CreateEgressOnlyInternetGatewayInput, accountID string) (*ec2.CreateEgressOnlyInternetGatewayOutput, error) {
+	return utils.NATSRequest[ec2.CreateEgressOnlyInternetGatewayOutput](s.natsConn, "ec2.CreateEgressOnlyInternetGateway", input, 30*time.Second, accountID)
 }
 
-func (s *NATSEgressOnlyIGWService) DeleteEgressOnlyInternetGateway(input *ec2.DeleteEgressOnlyInternetGatewayInput) (*ec2.DeleteEgressOnlyInternetGatewayOutput, error) {
-	return utils.NATSRequest[ec2.DeleteEgressOnlyInternetGatewayOutput](s.natsConn, "ec2.DeleteEgressOnlyInternetGateway", input, 30*time.Second)
+func (s *NATSEgressOnlyIGWService) DeleteEgressOnlyInternetGateway(input *ec2.DeleteEgressOnlyInternetGatewayInput, accountID string) (*ec2.DeleteEgressOnlyInternetGatewayOutput, error) {
+	return utils.NATSRequest[ec2.DeleteEgressOnlyInternetGatewayOutput](s.natsConn, "ec2.DeleteEgressOnlyInternetGateway", input, 30*time.Second, accountID)
 }
 
-func (s *NATSEgressOnlyIGWService) DescribeEgressOnlyInternetGateways(input *ec2.DescribeEgressOnlyInternetGatewaysInput) (*ec2.DescribeEgressOnlyInternetGatewaysOutput, error) {
-	return utils.NATSRequest[ec2.DescribeEgressOnlyInternetGatewaysOutput](s.natsConn, "ec2.DescribeEgressOnlyInternetGateways", input, 30*time.Second)
+func (s *NATSEgressOnlyIGWService) DescribeEgressOnlyInternetGateways(input *ec2.DescribeEgressOnlyInternetGatewaysInput, accountID string) (*ec2.DescribeEgressOnlyInternetGatewaysOutput, error) {
+	return utils.NATSRequest[ec2.DescribeEgressOnlyInternetGatewaysOutput](s.natsConn, "ec2.DescribeEgressOnlyInternetGateways", input, 30*time.Second, accountID)
 }
diff --git a/hive/handlers/ec2/igw/service.go b/hive/handlers/ec2/igw/service.go
index 89774d859..d6342880a 100644
--- a/hive/handlers/ec2/igw/service.go
+++ b/hive/handlers/ec2/igw/service.go
@@ -4,9 +4,9 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // IGWService defines the interface for Internet Gateway operations
 type IGWService interface {
-	CreateInternetGateway(input *ec2.CreateInternetGatewayInput) (*ec2.CreateInternetGatewayOutput, error)
-	DeleteInternetGateway(input *ec2.DeleteInternetGatewayInput) (*ec2.DeleteInternetGatewayOutput, error)
-	DescribeInternetGateways(input *ec2.DescribeInternetGatewaysInput) (*ec2.DescribeInternetGatewaysOutput, error)
-	AttachInternetGateway(input *ec2.AttachInternetGatewayInput) (*ec2.AttachInternetGatewayOutput, error)
-	DetachInternetGateway(input *ec2.DetachInternetGatewayInput) (*ec2.DetachInternetGatewayOutput, error)
+	CreateInternetGateway(input *ec2.CreateInternetGatewayInput, accountID string) (*ec2.CreateInternetGatewayOutput, error)
+	DeleteInternetGateway(input *ec2.DeleteInternetGatewayInput, accountID string) (*ec2.DeleteInternetGatewayOutput, error)
+	DescribeInternetGateways(input *ec2.DescribeInternetGatewaysInput, accountID string) (*ec2.DescribeInternetGatewaysOutput, error)
+	AttachInternetGateway(input *ec2.AttachInternetGatewayInput, accountID string) (*ec2.AttachInternetGatewayOutput, error)
+	DetachInternetGateway(input *ec2.DetachInternetGatewayInput, accountID string) (*ec2.DetachInternetGatewayOutput, error)
 }
diff --git a/hive/handlers/ec2/igw/service_impl.go b/hive/handlers/ec2/igw/service_impl.go
index f9176ca20..ae09c3b6a 100644
--- a/hive/handlers/ec2/igw/service_impl.go
+++ b/hive/handlers/ec2/igw/service_impl.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -19,6 +20,7 @@ import (
 var _ IGWService = (*IGWServiceImpl)(nil)
 
 const KVBucketIGW = "hive-igw"
+const kvBucketVPCs = "hive-vpc-vpcs"
 
 // IGWRecord represents a stored Internet Gateway
 type IGWRecord struct {
@@ -33,6 +35,7 @@ type IGWRecord struct {
 type IGWServiceImpl struct {
 	config   *config.Config
 	igwKV    nats.KeyValue
+	vpcKV    nats.KeyValue
 	natsConn *nats.Conn
 }
 
@@ -55,11 +58,18 @@ func NewIGWServiceImplWithNATS(cfg *config.Config, natsConn *nats.Conn) (*IGWSer
 		return nil, fmt.Errorf("failed to create KV bucket %s: %w", KVBucketIGW, err)
 	}
 
+	// Get VPC KV bucket for cross-resource ownership validation
+	vpcKV, err := js.KeyValue(kvBucketVPCs)
+	if err != nil {
+		slog.Warn("IGW service: VPC KV bucket not available, VPC ownership checks disabled", "error", err)
+	}
+
 	slog.Info("IGW service initialized with JetStream KV", "bucket", KVBucketIGW)
 
 	return &IGWServiceImpl{
 		config:   cfg,
 		igwKV:    igwKV,
+		vpcKV:    vpcKV,
 		natsConn: natsConn,
 	}, nil
 }
@@ -78,8 +88,12 @@ func getOrCreateKVBucket(js nats.JetStreamContext, bucketName string, history in
 	return kv, nil
 }
 
+func accountKey(accountID, resourceID string) string {
+	return accountID + "." + resourceID
+}
+
 // CreateInternetGateway creates a new Internet Gateway (initially detached)
-func (s *IGWServiceImpl) CreateInternetGateway(input *ec2.CreateInternetGatewayInput) (*ec2.CreateInternetGatewayOutput, error) {
+func (s *IGWServiceImpl) CreateInternetGateway(input *ec2.CreateInternetGatewayInput, accountID string) (*ec2.CreateInternetGatewayOutput, error) {
 	igwID := utils.GenerateResourceID("igw")
 
 	record := IGWRecord{
@@ -103,11 +117,11 @@ func (s *IGWServiceImpl) CreateInternetGateway(input *ec2.CreateInternetGatewayI
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal IGW record: %w", err)
 	}
-	if _, err := s.igwKV.Put(igwID, data); err != nil {
+	if _, err := s.igwKV.Put(accountKey(accountID, igwID), data); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("CreateInternetGateway completed", "internetGatewayId", igwID)
+	slog.Info("CreateInternetGateway completed", "internetGatewayId", igwID, "accountID", accountID)
 
 	return &ec2.CreateInternetGatewayOutput{
 		InternetGateway: s.recordToEC2(&record),
@@ -115,14 +129,15 @@ func (s *IGWServiceImpl) CreateInternetGateway(input *ec2.CreateInternetGatewayI
 }
 
 // DeleteInternetGateway deletes an Internet Gateway (must be detached first)
-func (s *IGWServiceImpl) DeleteInternetGateway(input *ec2.DeleteInternetGatewayInput) (*ec2.DeleteInternetGatewayOutput, error) {
+func (s *IGWServiceImpl) DeleteInternetGateway(input *ec2.DeleteInternetGatewayInput, accountID string) (*ec2.DeleteInternetGatewayOutput, error) {
 	if input.InternetGatewayId == nil || *input.InternetGatewayId == "" {
 		return nil, errors.New(awserrors.ErrorMissingParameter)
 	}
 
 	igwID := *input.InternetGatewayId
+	key := accountKey(accountID, igwID)
 
-	entry, err := s.igwKV.Get(igwID)
+	entry, err := s.igwKV.Get(key)
 	if err != nil {
 		return nil, errors.New(awserrors.ErrorInvalidInternetGatewayIDNotFound)
 	}
@@ -137,17 +152,17 @@ func (s *IGWServiceImpl) DeleteInternetGateway(input *ec2.DeleteInternetGatewayI
 		return nil, errors.New(awserrors.ErrorDependencyViolation)
 	}
 
-	if err := s.igwKV.Delete(igwID); err != nil {
+	if err := s.igwKV.Delete(key); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("DeleteInternetGateway completed", "internetGatewayId", igwID)
+	slog.Info("DeleteInternetGateway completed", "internetGatewayId", igwID, "accountID", accountID)
 
 	return &ec2.DeleteInternetGatewayOutput{}, nil
 }
 
 // DescribeInternetGateways lists Internet Gateways, optionally filtered by ID
-func (s *IGWServiceImpl) DescribeInternetGateways(input *ec2.DescribeInternetGatewaysInput) (*ec2.DescribeInternetGatewaysOutput, error) {
+func (s *IGWServiceImpl) DescribeInternetGateways(input *ec2.DescribeInternetGatewaysInput, accountID string) (*ec2.DescribeInternetGatewaysOutput, error) {
 	var igws []*ec2.InternetGateway
 
 	igwIDs := make(map[string]bool)
@@ -157,13 +172,16 @@ func (s *IGWServiceImpl) DescribeInternetGateways(input *ec2.DescribeInternetGat
 		}
 	}
 
+	prefix := accountID + "."
 	keys, err := s.igwKV.Keys()
 	if err != nil && !errors.Is(err, nats.ErrNoKeysFound) {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
+	foundIDs := make(map[string]bool)
+
 	for _, key := range keys {
-		if len(igwIDs) > 0 && !igwIDs[key] {
+		if !strings.HasPrefix(key, prefix) {
 			continue
 		}
 
@@ -179,10 +197,22 @@ func (s *IGWServiceImpl) DescribeInternetGateways(input *ec2.DescribeInternetGat
 			continue
 		}
 
+		if len(igwIDs) > 0 && !igwIDs[record.InternetGatewayId] {
+			continue
+		}
+
 		igws = append(igws, s.recordToEC2(&record))
+		foundIDs[record.InternetGatewayId] = true
 	}
 
-	slog.Info("DescribeInternetGateways completed", "count", len(igws))
+	// Return error if specific IDs were requested but not found
+	for id := range igwIDs {
+		if !foundIDs[id] {
+			return nil, errors.New(awserrors.ErrorInvalidInternetGatewayIDNotFound)
+		}
+	}
+
+	slog.Info("DescribeInternetGateways completed", "count", len(igws), "accountID", accountID)
 
 	return &ec2.DescribeInternetGatewaysOutput{
 		InternetGateways: igws,
@@ -191,7 +221,7 @@ func (s *IGWServiceImpl) DescribeInternetGateways(input *ec2.DescribeInternetGat
 
 // AttachInternetGateway attaches an IGW to a VPC and publishes a NATS event
 // for vpcd to create the OVN external switch, gateway port, and SNAT rules.
-func (s *IGWServiceImpl) AttachInternetGateway(input *ec2.AttachInternetGatewayInput) (*ec2.AttachInternetGatewayOutput, error) {
+func (s *IGWServiceImpl) AttachInternetGateway(input *ec2.AttachInternetGatewayInput, accountID string) (*ec2.AttachInternetGatewayOutput, error) {
 	if input.InternetGatewayId == nil || *input.InternetGatewayId == "" {
 		return nil, errors.New(awserrors.ErrorMissingParameter)
 	}
@@ -201,8 +231,9 @@ func (s *IGWServiceImpl) AttachInternetGateway(input *ec2.AttachInternetGatewayI
 
 	igwID := *input.InternetGatewayId
 	vpcID := *input.VpcId
+	key := accountKey(accountID, igwID)
 
-	entry, err := s.igwKV.Get(igwID)
+	entry, err := s.igwKV.Get(key)
 	if err != nil {
 		return nil, errors.New(awserrors.ErrorInvalidInternetGatewayIDNotFound)
 	}
@@ -216,6 +247,14 @@ func (s *IGWServiceImpl) AttachInternetGateway(input *ec2.AttachInternetGatewayI
 		return nil, errors.New(awserrors.ErrorResourceAlreadyAssociated)
 	}
 
+	// Verify the caller owns the target VPC
+	if s.vpcKV != nil {
+		if _, err := s.vpcKV.Get(accountKey(accountID, vpcID)); err != nil {
+			slog.Warn("AttachInternetGateway: VPC not found for account", "vpcId", vpcID, "accountID", accountID)
+			return nil, errors.New(awserrors.ErrorInvalidVpcIDNotFound)
+		}
+	}
+
 	record.VpcId = vpcID
 	record.State = "attached"
 
@@ -223,7 +262,7 @@ func (s *IGWServiceImpl) AttachInternetGateway(input *ec2.AttachInternetGatewayI
 	if err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
-	if _, err := s.igwKV.Put(igwID, data); err != nil {
+	if _, err := s.igwKV.Put(key, data); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
@@ -239,14 +278,14 @@ func (s *IGWServiceImpl) AttachInternetGateway(input *ec2.AttachInternetGatewayI
 		}
 	}
 
-	slog.Info("AttachInternetGateway completed", "internetGatewayId", igwID, "vpcId", vpcID)
+	slog.Info("AttachInternetGateway completed", "internetGatewayId", igwID, "vpcId", vpcID, "accountID", accountID)
 
 	return &ec2.AttachInternetGatewayOutput{}, nil
 }
 
 // DetachInternetGateway detaches an IGW from a VPC and publishes a NATS event
 // for vpcd to clean up the OVN external switch, gateway port, and NAT rules.
-func (s *IGWServiceImpl) DetachInternetGateway(input *ec2.DetachInternetGatewayInput) (*ec2.DetachInternetGatewayOutput, error) {
+func (s *IGWServiceImpl) DetachInternetGateway(input *ec2.DetachInternetGatewayInput, accountID string) (*ec2.DetachInternetGatewayOutput, error) {
 	if input.InternetGatewayId == nil || *input.InternetGatewayId == "" {
 		return nil, errors.New(awserrors.ErrorMissingParameter)
 	}
@@ -256,8 +295,9 @@ func (s *IGWServiceImpl) DetachInternetGateway(input *ec2.DetachInternetGatewayI
 
 	igwID := *input.InternetGatewayId
 	vpcID := *input.VpcId
+	key := accountKey(accountID, igwID)
 
-	entry, err := s.igwKV.Get(igwID)
+	entry, err := s.igwKV.Get(key)
 	if err != nil {
 		return nil, errors.New(awserrors.ErrorInvalidInternetGatewayIDNotFound)
 	}
@@ -278,7 +318,7 @@ func (s *IGWServiceImpl) DetachInternetGateway(input *ec2.DetachInternetGatewayI
 	if err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
-	if _, err := s.igwKV.Put(igwID, data); err != nil {
+	if _, err := s.igwKV.Put(key, data); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
@@ -294,7 +334,7 @@ func (s *IGWServiceImpl) DetachInternetGateway(input *ec2.DetachInternetGatewayI
 		}
 	}
 
-	slog.Info("DetachInternetGateway completed", "internetGatewayId", igwID, "vpcId", vpcID)
+	slog.Info("DetachInternetGateway completed", "internetGatewayId", igwID, "vpcId", vpcID, "accountID", accountID)
 
 	return &ec2.DetachInternetGatewayOutput{}, nil
 }
diff --git a/hive/handlers/ec2/igw/service_impl_test.go b/hive/handlers/ec2/igw/service_impl_test.go
index 93235f826..e0af84716 100644
--- a/hive/handlers/ec2/igw/service_impl_test.go
+++ b/hive/handlers/ec2/igw/service_impl_test.go
@@ -39,14 +39,14 @@ func setupTestIGWService(t *testing.T) (*IGWServiceImpl, *nats.Conn) {
 
 func createTestIGW(t *testing.T, svc *IGWServiceImpl) string {
 	t.Helper()
-	out, err := svc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{})
+	out, err := svc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, testAccountID)
 	require.NoError(t, err)
 	return *out.InternetGateway.InternetGatewayId
 }
 
 func TestCreateInternetGateway(t *testing.T) {
 	svc, _ := setupTestIGWService(t)
-	out, err := svc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{})
+	out, err := svc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out.InternetGateway)
 	assert.Equal(t, "igw-", (*out.InternetGateway.InternetGatewayId)[:4])
@@ -66,14 +66,14 @@ func TestCreateInternetGateway_WithTags(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, out.InternetGateway.Tags, 2)
 
 	// Verify tags persist through describe
 	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{
 		InternetGatewayIds: []*string{out.InternetGateway.InternetGatewayId},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.InternetGateways, 1)
 	assert.Len(t, desc.InternetGateways[0].Tags, 2)
@@ -90,7 +90,7 @@ func TestCreateInternetGateway_TagsWrongResourceType(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, out.InternetGateway.Tags)
 }
@@ -101,27 +101,26 @@ func TestDeleteInternetGateway(t *testing.T) {
 
 	_, err := svc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
-	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{
+	_, err = svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{
 		InternetGatewayIds: []*string{aws.String(igwID)},
-	})
-	require.NoError(t, err)
-	assert.Empty(t, desc.InternetGateways)
+	}, testAccountID)
+	assert.ErrorContains(t, err, "InvalidInternetGatewayID.NotFound")
 }
 
 func TestDeleteInternetGateway_NotFound(t *testing.T) {
 	svc, _ := setupTestIGWService(t)
 	_, err := svc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String("igw-nonexistent"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidInternetGatewayID.NotFound")
 }
 
 func TestDeleteInternetGateway_MissingID(t *testing.T) {
 	svc, _ := setupTestIGWService(t)
-	_, err := svc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{})
+	_, err := svc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -129,7 +128,7 @@ func TestDeleteInternetGateway_EmptyID(t *testing.T) {
 	svc, _ := setupTestIGWService(t)
 	_, err := svc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(""),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -141,13 +140,13 @@ func TestDeleteInternetGateway_WhileAttached(t *testing.T) {
 	_, err := svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Try to delete — should fail with DependencyViolation
 	_, err = svc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "DependencyViolation")
 }
 
@@ -156,7 +155,7 @@ func TestDescribeInternetGateways_All(t *testing.T) {
 	createTestIGW(t, svc)
 	createTestIGW(t, svc)
 
-	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{})
+	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, desc.InternetGateways, 2)
 }
@@ -168,7 +167,7 @@ func TestDescribeInternetGateways_ByID(t *testing.T) {
 
 	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{
 		InternetGatewayIds: []*string{aws.String(igwID)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.InternetGateways, 1)
 	assert.Equal(t, igwID, *desc.InternetGateways[0].InternetGatewayId)
@@ -176,7 +175,7 @@ func TestDescribeInternetGateways_ByID(t *testing.T) {
 
 func TestDescribeInternetGateways_Empty(t *testing.T) {
 	svc, _ := setupTestIGWService(t)
-	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{})
+	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, desc.InternetGateways)
 }
@@ -188,13 +187,13 @@ func TestAttachInternetGateway(t *testing.T) {
 	_, err := svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify attachment via describe
 	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{
 		InternetGatewayIds: []*string{aws.String(igwID)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.InternetGateways, 1)
 	require.Len(t, desc.InternetGateways[0].Attachments, 1)
@@ -207,7 +206,7 @@ func TestAttachInternetGateway_NotFound(t *testing.T) {
 	_, err := svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String("igw-nonexistent"),
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidInternetGatewayID.NotFound")
 }
 
@@ -218,14 +217,14 @@ func TestAttachInternetGateway_AlreadyAttached(t *testing.T) {
 	_, err := svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Try attaching again — should fail
 	_, err = svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-other"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "Resource.AlreadyAssociated")
 }
 
@@ -233,12 +232,12 @@ func TestAttachInternetGateway_MissingParams(t *testing.T) {
 	svc, _ := setupTestIGWService(t)
 	_, err := svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		VpcId: aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 
 	_, err = svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String("igw-test"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -250,20 +249,20 @@ func TestDetachInternetGateway(t *testing.T) {
 	_, err := svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Detach
 	_, err = svc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify detached
 	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{
 		InternetGatewayIds: []*string{aws.String(igwID)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.InternetGateways, 1)
 	assert.Empty(t, desc.InternetGateways[0].Attachments)
@@ -276,7 +275,7 @@ func TestDetachInternetGateway_NotAttached(t *testing.T) {
 	_, err := svc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "Gateway.NotAttached")
 }
 
@@ -287,14 +286,14 @@ func TestDetachInternetGateway_WrongVPC(t *testing.T) {
 	_, err := svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Try detaching from wrong VPC
 	_, err = svc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-wrong"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "Gateway.NotAttached")
 }
 
@@ -303,7 +302,7 @@ func TestDetachInternetGateway_NotFound(t *testing.T) {
 	_, err := svc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String("igw-nonexistent"),
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidInternetGatewayID.NotFound")
 }
 
@@ -311,12 +310,12 @@ func TestDetachInternetGateway_MissingParams(t *testing.T) {
 	svc, _ := setupTestIGWService(t)
 	_, err := svc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		VpcId: aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 
 	_, err = svc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String("igw-test"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -330,30 +329,30 @@ func TestIGWLifecycle_CreateAttachDetachDelete(t *testing.T) {
 	_, err := svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-lifecycle"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Cannot delete while attached
 	_, err = svc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "DependencyViolation")
 
 	// Detach
 	_, err = svc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-lifecycle"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Now delete succeeds
 	_, err = svc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify gone
-	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{})
+	desc, err := svc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, desc.InternetGateways)
 }
@@ -373,7 +372,7 @@ func TestAttachInternetGateway_PublishesEvent(t *testing.T) {
 	_, err = svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-event-test"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify event was published
@@ -394,7 +393,7 @@ func TestDetachInternetGateway_PublishesEvent(t *testing.T) {
 	_, err := svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-event-test"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Subscribe to IGW detach events
@@ -408,7 +407,7 @@ func TestDetachInternetGateway_PublishesEvent(t *testing.T) {
 	_, err = svc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-event-test"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify event was published
@@ -432,7 +431,7 @@ func TestCreateInternetGateway_PublishesNoEvent(t *testing.T) {
 	require.NoError(t, err)
 	defer func() { _ = sub.Unsubscribe() }()
 
-	_, err = svc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{})
+	_, err = svc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify no event was published
@@ -452,6 +451,46 @@ func TestNewIGWServiceImpl(t *testing.T) {
 	assert.Nil(t, svc.natsConn)
 }
 
+// TestAttachInternetGateway_CrossAccountVPCRejected tests that attaching an IGW to another account's VPC is rejected.
+func TestAttachInternetGateway_CrossAccountVPCRejected(t *testing.T) {
+	svc, nc := setupTestIGWService(t)
+
+	// Create VPC KV bucket and add a VPC owned by testAccountID
+	js, err := nc.JetStream()
+	require.NoError(t, err)
+	vpcKV, err := js.CreateKeyValue(&nats.KeyValueConfig{Bucket: kvBucketVPCs, History: 1})
+	require.NoError(t, err)
+
+	vpcID := "vpc-alpha123"
+	_, err = vpcKV.Put(accountKey(testAccountID, vpcID), []byte(`{"vpc_id":"vpc-alpha123","state":"available"}`))
+	require.NoError(t, err)
+
+	// Refresh service to pick up the VPC KV bucket
+	svc.vpcKV = vpcKV
+
+	// Create IGW owned by otherAccountID
+	otherAccount := "999999999999"
+	out, err := svc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, otherAccount)
+	require.NoError(t, err)
+	igwID := *out.InternetGateway.InternetGatewayId
+
+	// Other account tries to attach their IGW to testAccountID's VPC — should fail
+	_, err = svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
+		InternetGatewayId: aws.String(igwID),
+		VpcId:             aws.String(vpcID),
+	}, otherAccount)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "InvalidVpcID.NotFound")
+
+	// Owner attaches their own IGW to their own VPC — should succeed
+	ownIGW := createTestIGW(t, svc)
+	_, err = svc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
+		InternetGatewayId: aws.String(ownIGW),
+		VpcId:             aws.String(vpcID),
+	}, testAccountID)
+	require.NoError(t, err)
+}
+
 func TestDeleteInternetGateway_PublishesNoEvent(t *testing.T) {
 	svc, nc := setupTestIGWService(t)
 	igwID := createTestIGW(t, svc)
@@ -466,7 +505,7 @@ func TestDeleteInternetGateway_PublishesNoEvent(t *testing.T) {
 
 	_, err = svc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify no event was published
diff --git a/hive/handlers/ec2/igw/service_nats.go b/hive/handlers/ec2/igw/service_nats.go
index 9c6da8e59..a9b738f8c 100644
--- a/hive/handlers/ec2/igw/service_nats.go
+++ b/hive/handlers/ec2/igw/service_nats.go
@@ -18,22 +18,22 @@ func NewNATSIGWService(conn *nats.Conn) IGWService {
 	return &NATSIGWService{natsConn: conn}
 }
 
-func (s *NATSIGWService) CreateInternetGateway(input *ec2.CreateInternetGatewayInput) (*ec2.CreateInternetGatewayOutput, error) {
-	return utils.NATSRequest[ec2.CreateInternetGatewayOutput](s.natsConn, "ec2.CreateInternetGateway", input, 30*time.Second)
+func (s *NATSIGWService) CreateInternetGateway(input *ec2.CreateInternetGatewayInput, accountID string) (*ec2.CreateInternetGatewayOutput, error) {
+	return utils.NATSRequest[ec2.CreateInternetGatewayOutput](s.natsConn, "ec2.CreateInternetGateway", input, 30*time.Second, accountID)
 }
 
-func (s *NATSIGWService) DeleteInternetGateway(input *ec2.DeleteInternetGatewayInput) (*ec2.DeleteInternetGatewayOutput, error) {
-	return utils.NATSRequest[ec2.DeleteInternetGatewayOutput](s.natsConn, "ec2.DeleteInternetGateway", input, 30*time.Second)
+func (s *NATSIGWService) DeleteInternetGateway(input *ec2.DeleteInternetGatewayInput, accountID string) (*ec2.DeleteInternetGatewayOutput, error) {
+	return utils.NATSRequest[ec2.DeleteInternetGatewayOutput](s.natsConn, "ec2.DeleteInternetGateway", input, 30*time.Second, accountID)
 }
 
-func (s *NATSIGWService) DescribeInternetGateways(input *ec2.DescribeInternetGatewaysInput) (*ec2.DescribeInternetGatewaysOutput, error) {
-	return utils.NATSRequest[ec2.DescribeInternetGatewaysOutput](s.natsConn, "ec2.DescribeInternetGateways", input, 30*time.Second)
+func (s *NATSIGWService) DescribeInternetGateways(input *ec2.DescribeInternetGatewaysInput, accountID string) (*ec2.DescribeInternetGatewaysOutput, error) {
+	return utils.NATSRequest[ec2.DescribeInternetGatewaysOutput](s.natsConn, "ec2.DescribeInternetGateways", input, 30*time.Second, accountID)
 }
 
-func (s *NATSIGWService) AttachInternetGateway(input *ec2.AttachInternetGatewayInput) (*ec2.AttachInternetGatewayOutput, error) {
-	return utils.NATSRequest[ec2.AttachInternetGatewayOutput](s.natsConn, "ec2.AttachInternetGateway", input, 30*time.Second)
+func (s *NATSIGWService) AttachInternetGateway(input *ec2.AttachInternetGatewayInput, accountID string) (*ec2.AttachInternetGatewayOutput, error) {
+	return utils.NATSRequest[ec2.AttachInternetGatewayOutput](s.natsConn, "ec2.AttachInternetGateway", input, 30*time.Second, accountID)
 }
 
-func (s *NATSIGWService) DetachInternetGateway(input *ec2.DetachInternetGatewayInput) (*ec2.DetachInternetGatewayOutput, error) {
-	return utils.NATSRequest[ec2.DetachInternetGatewayOutput](s.natsConn, "ec2.DetachInternetGateway", input, 30*time.Second)
+func (s *NATSIGWService) DetachInternetGateway(input *ec2.DetachInternetGatewayInput, accountID string) (*ec2.DetachInternetGatewayOutput, error) {
+	return utils.NATSRequest[ec2.DetachInternetGatewayOutput](s.natsConn, "ec2.DetachInternetGateway", input, 30*time.Second, accountID)
 }
diff --git a/hive/handlers/ec2/igw/service_nats_test.go b/hive/handlers/ec2/igw/service_nats_test.go
index dbca46218..61692f298 100644
--- a/hive/handlers/ec2/igw/service_nats_test.go
+++ b/hive/handlers/ec2/igw/service_nats_test.go
@@ -11,6 +11,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+const testAccountID = "123456789012"
+
 // setupNATSIGWServiceTest creates a NATSIGWService client connected to an
 // IGWServiceImpl backend via NATS.
 func setupNATSIGWServiceTest(t *testing.T) (IGWService, *IGWServiceImpl) {
@@ -36,13 +38,14 @@ func setupNATSIGWServiceTest(t *testing.T) (IGWService, *IGWServiceImpl) {
 	return client, backend
 }
 
-func handleNATSMsg[In any, Out any](msg *nats.Msg, fn func(*In) (*Out, error)) {
+func handleNATSMsg[In any, Out any](msg *nats.Msg, fn func(*In, string) (*Out, error)) {
 	var input In
 	if err := json.Unmarshal(msg.Data, &input); err != nil {
 		_ = msg.Respond([]byte(`{"error":"unmarshal"}`))
 		return
 	}
-	result, err := fn(&input)
+	accountID := msg.Header.Get("X-Account-ID")
+	result, err := fn(&input, accountID)
 	if err != nil {
 		errResp, _ := json.Marshal(map[string]string{"error": err.Error()})
 		_ = msg.Respond(errResp)
@@ -55,7 +58,7 @@ func handleNATSMsg[In any, Out any](msg *nats.Msg, fn func(*In) (*Out, error)) {
 func TestNATSIGWService_CreateInternetGateway(t *testing.T) {
 	client, _ := setupNATSIGWServiceTest(t)
 
-	out, err := client.CreateInternetGateway(&ec2.CreateInternetGatewayInput{})
+	out, err := client.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out.InternetGateway)
 	assert.NotEmpty(t, *out.InternetGateway.InternetGatewayId)
@@ -64,10 +67,10 @@ func TestNATSIGWService_CreateInternetGateway(t *testing.T) {
 func TestNATSIGWService_DescribeInternetGateways(t *testing.T) {
 	client, _ := setupNATSIGWServiceTest(t)
 
-	_, err := client.CreateInternetGateway(&ec2.CreateInternetGatewayInput{})
+	_, err := client.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, testAccountID)
 	require.NoError(t, err)
 
-	out, err := client.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{})
+	out, err := client.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.GreaterOrEqual(t, len(out.InternetGateways), 1)
 }
@@ -75,31 +78,31 @@ func TestNATSIGWService_DescribeInternetGateways(t *testing.T) {
 func TestNATSIGWService_DeleteInternetGateway(t *testing.T) {
 	client, _ := setupNATSIGWServiceTest(t)
 
-	createOut, err := client.CreateInternetGateway(&ec2.CreateInternetGatewayInput{})
+	createOut, err := client.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = client.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: createOut.InternetGateway.InternetGatewayId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 }
 
 func TestNATSIGWService_AttachAndDetach(t *testing.T) {
 	client, _ := setupNATSIGWServiceTest(t)
 
-	createOut, err := client.CreateInternetGateway(&ec2.CreateInternetGatewayInput{})
+	createOut, err := client.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, testAccountID)
 	require.NoError(t, err)
 	igwID := createOut.InternetGateway.InternetGatewayId
 
 	_, err = client.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: igwID,
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = client.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: igwID,
 		VpcId:             aws.String("vpc-test123"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 }
diff --git a/hive/handlers/ec2/image/service.go b/hive/handlers/ec2/image/service.go
index 6b919c5ef..e16c131e1 100644
--- a/hive/handlers/ec2/image/service.go
+++ b/hive/handlers/ec2/image/service.go
@@ -4,12 +4,12 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // ImageService defines the interface for EC2 image operations business logic
 type ImageService interface {
-	CreateImage(input *ec2.CreateImageInput) (*ec2.CreateImageOutput, error)
-	CopyImage(input *ec2.CopyImageInput) (*ec2.CopyImageOutput, error)
-	DescribeImages(input *ec2.DescribeImagesInput) (*ec2.DescribeImagesOutput, error)
-	DescribeImageAttribute(input *ec2.DescribeImageAttributeInput) (*ec2.DescribeImageAttributeOutput, error)
-	RegisterImage(input *ec2.RegisterImageInput) (*ec2.RegisterImageOutput, error)
-	DeregisterImage(input *ec2.DeregisterImageInput) (*ec2.DeregisterImageOutput, error)
-	ModifyImageAttribute(input *ec2.ModifyImageAttributeInput) (*ec2.ModifyImageAttributeOutput, error)
-	ResetImageAttribute(input *ec2.ResetImageAttributeInput) (*ec2.ResetImageAttributeOutput, error)
+	CreateImage(input *ec2.CreateImageInput, accountID string) (*ec2.CreateImageOutput, error)
+	CopyImage(input *ec2.CopyImageInput, accountID string) (*ec2.CopyImageOutput, error)
+	DescribeImages(input *ec2.DescribeImagesInput, accountID string) (*ec2.DescribeImagesOutput, error)
+	DescribeImageAttribute(input *ec2.DescribeImageAttributeInput, accountID string) (*ec2.DescribeImageAttributeOutput, error)
+	RegisterImage(input *ec2.RegisterImageInput, accountID string) (*ec2.RegisterImageOutput, error)
+	DeregisterImage(input *ec2.DeregisterImageInput, accountID string) (*ec2.DeregisterImageOutput, error)
+	ModifyImageAttribute(input *ec2.ModifyImageAttributeInput, accountID string) (*ec2.ModifyImageAttributeOutput, error)
+	ResetImageAttribute(input *ec2.ResetImageAttributeInput, accountID string) (*ec2.ResetImageAttributeOutput, error)
 }
diff --git a/hive/handlers/ec2/image/service_impl.go b/hive/handlers/ec2/image/service_impl.go
index 3a2edfaf4..48c238a54 100644
--- a/hive/handlers/ec2/image/service_impl.go
+++ b/hive/handlers/ec2/image/service_impl.go
@@ -41,7 +41,6 @@ type ImageServiceImpl struct {
 	store      objectstore.ObjectStore
 	natsConn   *nats.Conn
 	bucketName string
-	accountID  string // AWS account ID for S3 key storage path
 }
 
 // NewImageServiceImpl creates a new daemon-side image service
@@ -58,21 +57,19 @@ func NewImageServiceImpl(cfg *config.Config, natsConn *nats.Conn) *ImageServiceI
 		store:      store,
 		natsConn:   natsConn,
 		bucketName: cfg.Predastore.Bucket,
-		accountID:  "123456789", // TODO: Implement proper account ID management
 	}
 }
 
 // NewImageServiceImplWithStore creates an image service with a custom object store (for testing)
-func NewImageServiceImplWithStore(store objectstore.ObjectStore, bucketName, accountID string) *ImageServiceImpl {
+func NewImageServiceImplWithStore(store objectstore.ObjectStore, bucketName string) *ImageServiceImpl {
 	return &ImageServiceImpl{
 		store:      store,
 		bucketName: bucketName,
-		accountID:  accountID,
 	}
 }
 
 // DescribeImages lists available AMI images by reading config.json files from S3
-func (s *ImageServiceImpl) DescribeImages(input *ec2.DescribeImagesInput) (*ec2.DescribeImagesOutput, error) {
+func (s *ImageServiceImpl) DescribeImages(input *ec2.DescribeImagesInput, accountID string) (*ec2.DescribeImagesOutput, error) {
 	if input == nil {
 		input = &ec2.DescribeImagesInput{}
 	}
@@ -162,12 +159,38 @@ func (s *ImageServiceImpl) DescribeImages(input *ec2.DescribeImagesInput) (*ec2.
 			}
 		}
 
-		// Filter by Owner if specified (only support "self" and account IDs for now)
+		// Determine AMI ownership. Phase4+ AMIs store the creator's account ID
+		// in ImageOwnerAlias. Pre-phase4 AMIs have non-account values like "self"
+		// or "hive" and are treated as system/public images visible to all.
+		amiOwner := amiMeta.ImageOwnerAlias
+		isSystemAMI := !isAccountID(amiOwner)
+
+		// Visibility check: callers can only see their own AMIs and system AMIs.
+		// This runs regardless of whether an owner filter is specified.
+		if !isSystemAMI && amiOwner != accountID {
+			continue
+		}
+
+		// Filter by Owner if specified
 		if len(input.Owners) > 0 {
 			found := false
 			for _, owner := range input.Owners {
-				if owner != nil && (*owner == "self" || *owner == s.accountID || *owner == amiMeta.ImageOwnerAlias) {
-					found = true
+				if owner == nil {
+					continue
+				}
+				switch *owner {
+				case "self":
+					// "self" matches only AMIs owned by the caller
+					if amiOwner == accountID {
+						found = true
+					}
+				default:
+					// Match by explicit account ID
+					if amiOwner == *owner {
+						found = true
+					}
+				}
+				if found {
 					break
 				}
 			}
@@ -176,6 +199,12 @@ func (s *ImageServiceImpl) DescribeImages(input *ec2.DescribeImagesInput) (*ec2.
 			}
 		}
 
+		// Resolve the OwnerId for the response. System AMIs use global account.
+		ownerID := amiOwner
+		if isSystemAMI {
+			ownerID = "000000000000"
+		}
+
 		// Build EC2 Image from AMIMetadata
 		image := &ec2.Image{
 			ImageId:            aws.String(amiMeta.ImageID),
@@ -187,7 +216,7 @@ func (s *ImageServiceImpl) DescribeImages(input *ec2.DescribeImagesInput) (*ec2.
 			RootDeviceType:     aws.String(amiMeta.RootDeviceType),
 			VirtualizationType: aws.String(amiMeta.Virtualization),
 			ImageOwnerAlias:    aws.String(amiMeta.ImageOwnerAlias),
-			OwnerId:            aws.String(s.accountID),
+			OwnerId:            aws.String(ownerID),
 			Public:             aws.Bool(false),
 			State:              aws.String("available"),
 			ImageType:          aws.String("machine"),
@@ -249,13 +278,13 @@ func (s *ImageServiceImpl) DescribeImages(input *ec2.DescribeImagesInput) (*ec2.
 
 // CreateImage is the generic interface method — on the daemon side, the handler
 // calls CreateImageFromInstance directly with the extra instance context.
-func (s *ImageServiceImpl) CreateImage(input *ec2.CreateImageInput) (*ec2.CreateImageOutput, error) {
+func (s *ImageServiceImpl) CreateImage(input *ec2.CreateImageInput, accountID string) (*ec2.CreateImageOutput, error) {
 	return nil, errors.New("CreateImage requires instance context; use CreateImageFromInstance on daemon side")
 }
 
 // CreateImageFromInstance creates an AMI from an instance by snapshotting the root
 // volume and storing a new AMI config in S3.
-func (s *ImageServiceImpl) CreateImageFromInstance(params CreateImageParams) (*ec2.CreateImageOutput, error) {
+func (s *ImageServiceImpl) CreateImageFromInstance(params CreateImageParams, accountID string) (*ec2.CreateImageOutput, error) {
 	input := params.Input
 	if input == nil || input.InstanceId == nil {
 		return nil, errors.New(awserrors.ErrorInvalidParameterValue)
@@ -312,7 +341,7 @@ func (s *ImageServiceImpl) CreateImageFromInstance(params CreateImageParams) (*e
 	}
 
 	// Step 4: Store snapshot metadata
-	if err := s.putSnapshotMetadata(snapshotID, params.RootVolumeID, volumeSizeGiB); err != nil {
+	if err := s.putSnapshotMetadata(snapshotID, params.RootVolumeID, volumeSizeGiB, accountID); err != nil {
 		slog.Error("CreateImageFromInstance: failed to write snapshot metadata", "snapshotId", snapshotID, "err", err)
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -333,7 +362,7 @@ func (s *ImageServiceImpl) CreateImageFromInstance(params CreateImageParams) (*e
 				VolumeSizeGiB:   volumeSizeGiB,
 				CreationDate:    time.Now(),
 				RootDeviceType:  "ebs",
-				ImageOwnerAlias: "self",
+				ImageOwnerAlias: accountID,
 			},
 		},
 	}
@@ -538,7 +567,7 @@ func (s *ImageServiceImpl) GetAMIConfig(imageID string) (viperblock.AMIMetadata,
 }
 
 // putSnapshotMetadata stores snapshot metadata in S3 using the canonical SnapshotConfig type
-func (s *ImageServiceImpl) putSnapshotMetadata(snapshotID, volumeID string, volumeSizeGiB uint64) error {
+func (s *ImageServiceImpl) putSnapshotMetadata(snapshotID, volumeID string, volumeSizeGiB uint64, accountID string) error {
 	cfg := handlers_ec2_snapshot.SnapshotConfig{
 		SnapshotID: snapshotID,
 		VolumeID:   volumeID,
@@ -546,7 +575,7 @@ func (s *ImageServiceImpl) putSnapshotMetadata(snapshotID, volumeID string, volu
 		State:      "completed",
 		Progress:   "100%",
 		StartTime:  time.Now(),
-		OwnerID:    s.accountID,
+		OwnerID:    accountID,
 	}
 
 	data, err := json.Marshal(cfg)
@@ -564,26 +593,40 @@ func (s *ImageServiceImpl) putSnapshotMetadata(snapshotID, volumeID string, volu
 	return err
 }
 
-func (s *ImageServiceImpl) CopyImage(input *ec2.CopyImageInput) (*ec2.CopyImageOutput, error) {
+// isAccountID returns true if the string looks like a valid Hive account ID
+// (12-digit zero-padded number). Pre-phase4 values like "self" or "hive" return false.
+func isAccountID(s string) bool {
+	if len(s) != 12 {
+		return false
+	}
+	for _, c := range s {
+		if c < '0' || c > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+func (s *ImageServiceImpl) CopyImage(input *ec2.CopyImageInput, accountID string) (*ec2.CopyImageOutput, error) {
 	return nil, errors.New("CopyImage not yet implemented")
 }
 
-func (s *ImageServiceImpl) DescribeImageAttribute(input *ec2.DescribeImageAttributeInput) (*ec2.DescribeImageAttributeOutput, error) {
+func (s *ImageServiceImpl) DescribeImageAttribute(input *ec2.DescribeImageAttributeInput, accountID string) (*ec2.DescribeImageAttributeOutput, error) {
 	return nil, errors.New("DescribeImageAttribute not yet implemented")
 }
 
-func (s *ImageServiceImpl) RegisterImage(input *ec2.RegisterImageInput) (*ec2.RegisterImageOutput, error) {
+func (s *ImageServiceImpl) RegisterImage(input *ec2.RegisterImageInput, accountID string) (*ec2.RegisterImageOutput, error) {
 	return nil, errors.New("RegisterImage not yet implemented")
 }
 
-func (s *ImageServiceImpl) DeregisterImage(input *ec2.DeregisterImageInput) (*ec2.DeregisterImageOutput, error) {
+func (s *ImageServiceImpl) DeregisterImage(input *ec2.DeregisterImageInput, accountID string) (*ec2.DeregisterImageOutput, error) {
 	return nil, errors.New("DeregisterImage not yet implemented")
 }
 
-func (s *ImageServiceImpl) ModifyImageAttribute(input *ec2.ModifyImageAttributeInput) (*ec2.ModifyImageAttributeOutput, error) {
+func (s *ImageServiceImpl) ModifyImageAttribute(input *ec2.ModifyImageAttributeInput, accountID string) (*ec2.ModifyImageAttributeOutput, error) {
 	return nil, errors.New("ModifyImageAttribute not yet implemented")
 }
 
-func (s *ImageServiceImpl) ResetImageAttribute(input *ec2.ResetImageAttributeInput) (*ec2.ResetImageAttributeOutput, error) {
+func (s *ImageServiceImpl) ResetImageAttribute(input *ec2.ResetImageAttributeInput, accountID string) (*ec2.ResetImageAttributeOutput, error) {
 	return nil, errors.New("ResetImageAttribute not yet implemented")
 }
diff --git a/hive/handlers/ec2/image/service_impl_test.go b/hive/handlers/ec2/image/service_impl_test.go
index 2c8514ae7..25ce40316 100644
--- a/hive/handlers/ec2/image/service_impl_test.go
+++ b/hive/handlers/ec2/image/service_impl_test.go
@@ -17,12 +17,12 @@ import (
 )
 
 const testBucket = "test-bucket"
-const testAccountID = "123456789"
+const testAccountID = "000000000001"
 
 // setupTestImageService creates an image service with in-memory storage for testing
 func setupTestImageService(t *testing.T) (*ImageServiceImpl, *objectstore.MemoryObjectStore) {
 	store := objectstore.NewMemoryObjectStore()
-	svc := NewImageServiceImplWithStore(store, testBucket, testAccountID)
+	svc := NewImageServiceImplWithStore(store, testBucket)
 	return svc, store
 }
 
@@ -101,10 +101,38 @@ func createTestAMIConfigWithName(t *testing.T, store *objectstore.MemoryObjectSt
 	require.NoError(t, err)
 }
 
+// createTestAMIConfigWithOwner creates a test AMI config with a specified name and owner
+func createTestAMIConfigWithOwner(t *testing.T, store *objectstore.MemoryObjectStore, imageID, name, owner string) {
+	amiState := viperblock.VBState{
+		VolumeConfig: viperblock.VolumeConfig{
+			AMIMetadata: viperblock.AMIMetadata{
+				ImageID:         imageID,
+				Name:            name,
+				Architecture:    "x86_64",
+				PlatformDetails: "Linux/UNIX",
+				Virtualization:  "hvm",
+				RootDeviceType:  "ebs",
+				VolumeSizeGiB:   8,
+				ImageOwnerAlias: owner,
+			},
+		},
+	}
+	data, err := json.Marshal(amiState)
+	require.NoError(t, err)
+
+	_, err = store.PutObject(&awss3.PutObjectInput{
+		Bucket:      aws.String(testBucket),
+		Key:         aws.String(imageID + "/config.json"),
+		Body:        strings.NewReader(string(data)),
+		ContentType: aws.String("application/json"),
+	})
+	require.NoError(t, err)
+}
+
 func TestCreateImageFromInstance_NilInput(t *testing.T) {
 	svc, _ := setupTestImageService(t)
 
-	_, err := svc.CreateImageFromInstance(CreateImageParams{})
+	_, err := svc.CreateImageFromInstance(CreateImageParams{}, testAccountID)
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidParameterValue, err.Error())
 }
@@ -125,7 +153,7 @@ func TestCreateImageFromInstance_RunningInstance_NoNATS(t *testing.T) {
 		RootVolumeID:  "vol-root123",
 		SourceImageID: "ami-source123",
 		IsRunning:     true,
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorServerInternal, err.Error())
 }
@@ -142,7 +170,7 @@ func TestCreateImageFromInstance_StoppedInstance_NoConfig(t *testing.T) {
 		RootVolumeID:  "vol-nonexistent",
 		SourceImageID: "ami-source123",
 		IsRunning:     false,
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorServerInternal, err.Error())
 }
@@ -150,20 +178,21 @@ func TestCreateImageFromInstance_StoppedInstance_NoConfig(t *testing.T) {
 func TestDescribeImages_AfterCreate(t *testing.T) {
 	svc, store := setupTestImageService(t)
 
-	// Manually create an AMI config in the store (simulates what CreateImageFromInstance does)
+	// Manually create an AMI config with the caller as owner
 	amiID := "ami-testimage123"
-	createTestAMIConfig(t, store, amiID)
+	createTestAMIConfigWithOwner(t, store, amiID, "test-ami", testAccountID)
 
 	// Describe images should find it
 	result, err := svc.DescribeImages(&ec2.DescribeImagesInput{
 		ImageIds: []*string{aws.String(amiID)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, result)
 	require.Len(t, result.Images, 1)
 	assert.Equal(t, amiID, *result.Images[0].ImageId)
 	assert.Equal(t, "test-ami", *result.Images[0].Name)
 	assert.Equal(t, "x86_64", *result.Images[0].Architecture)
+	assert.Equal(t, testAccountID, *result.Images[0].OwnerId)
 }
 
 func TestGetVolumeConfig(t *testing.T) {
@@ -208,7 +237,7 @@ func TestGetAMIConfig_NotFound(t *testing.T) {
 func TestPutSnapshotMetadata(t *testing.T) {
 	svc, store := setupTestImageService(t)
 
-	err := svc.putSnapshotMetadata("snap-abc123", "vol-xyz789", 10)
+	err := svc.putSnapshotMetadata("snap-abc123", "vol-xyz789", 10, testAccountID)
 	require.NoError(t, err)
 
 	// Verify the metadata was written correctly
@@ -245,7 +274,7 @@ func TestCreateImageFromInstance_SourceAMIReadFailure(t *testing.T) {
 		RootVolumeID:  "vol-root123",
 		SourceImageID: "ami-nonexistent",
 		IsRunning:     true, // will fail at snapshot step first (no NATS)
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorServerInternal, err.Error())
 }
@@ -259,7 +288,7 @@ func TestDescribeImages_NotFound(t *testing.T) {
 	// Request a non-existent AMI ID — should return InvalidAMIID.NotFound
 	_, err := svc.DescribeImages(&ec2.DescribeImagesInput{
 		ImageIds: []*string{aws.String("ami-nonexistent")},
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidAMIIDNotFound, err.Error())
 }
@@ -276,7 +305,7 @@ func TestDescribeImages_MixedExistingAndMissing(t *testing.T) {
 			aws.String("ami-exists123"),
 			aws.String("ami-missing456"),
 		},
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidAMIIDNotFound, err.Error())
 }
@@ -284,38 +313,20 @@ func TestDescribeImages_MixedExistingAndMissing(t *testing.T) {
 func TestDescribeImages_FilterByOwnerSelf(t *testing.T) {
 	svc, store := setupTestImageService(t)
 
-	// Create AMI with "self" owner alias
-	amiID := "ami-selfowned"
-	amiState := viperblock.VBState{
-		VolumeConfig: viperblock.VolumeConfig{
-			AMIMetadata: viperblock.AMIMetadata{
-				ImageID:         amiID,
-				Name:            "self-owned-ami",
-				ImageOwnerAlias: "self",
-				Architecture:    "x86_64",
-				PlatformDetails: "Linux/UNIX",
-				RootDeviceType:  "ebs",
-				VolumeSizeGiB:   8,
-			},
-		},
-	}
-	data, err := json.Marshal(amiState)
-	require.NoError(t, err)
-	_, err = store.PutObject(&awss3.PutObjectInput{
-		Bucket: aws.String(testBucket),
-		Key:    aws.String(amiID + "/config.json"),
-		Body:   strings.NewReader(string(data)),
-	})
-	require.NoError(t, err)
+	// Create an AMI owned by the caller's account
+	createTestAMIConfigWithOwner(t, store, "ami-selfowned", "self-owned-ami", testAccountID)
 
-	// Filter by "self"
+	// Create a system AMI (should not appear with --owners self)
+	createTestAMIConfigWithOwner(t, store, "ami-system", "system-ami", "hive")
+
+	// Filter by "self" should return only the caller's AMI
 	result, err := svc.DescribeImages(&ec2.DescribeImagesInput{
 		Owners: []*string{aws.String("self")},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, result)
 	assert.Len(t, result.Images, 1)
-	assert.Equal(t, amiID, *result.Images[0].ImageId)
+	assert.Equal(t, "ami-selfowned", *result.Images[0].ImageId)
 }
 
 func TestCreateImageFromInstance_DuplicateName(t *testing.T) {
@@ -335,7 +346,7 @@ func TestCreateImageFromInstance_DuplicateName(t *testing.T) {
 		},
 		RootVolumeID: "vol-root123",
 		IsRunning:    true,
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidAMINameDuplicate, err.Error())
 }
@@ -358,8 +369,51 @@ func TestCreateImageFromInstance_UniqueNameAllowed(t *testing.T) {
 		},
 		RootVolumeID: "vol-root123",
 		IsRunning:    true,
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	// Should fail at snapshot, NOT at duplicate name check
 	assert.Equal(t, awserrors.ErrorServerInternal, err.Error())
 }
+
+func TestDescribeImages_AccountScoping(t *testing.T) {
+	svc, store := setupTestImageService(t)
+
+	// Create an AMI owned by a specific account
+	createTestAMIConfigWithOwner(t, store, "ami-scoped123", "test-ami", "000000000001")
+
+	// DescribeImages from the owning account should return the image with correct OwnerId
+	result, err := svc.DescribeImages(&ec2.DescribeImagesInput{
+		ImageIds: []*string{aws.String("ami-scoped123")},
+	}, "000000000001")
+	require.NoError(t, err)
+	require.Len(t, result.Images, 1)
+	assert.Equal(t, "000000000001", *result.Images[0].OwnerId)
+
+	// DescribeImages from a DIFFERENT account should NOT see the image
+	_, err = svc.DescribeImages(&ec2.DescribeImagesInput{
+		ImageIds: []*string{aws.String("ami-scoped123")},
+	}, "000000000002")
+	require.Error(t, err)
+	assert.Equal(t, awserrors.ErrorInvalidAMIIDNotFound, err.Error())
+}
+
+func TestDescribeImages_SystemAMIVisibleToAll(t *testing.T) {
+	svc, store := setupTestImageService(t)
+
+	// Create a system/pre-phase4 AMI (non-account-ID owner)
+	createTestAMIConfigWithOwner(t, store, "ami-system123", "system-ami", "hive")
+
+	// Any account should be able to see system AMIs
+	result, err := svc.DescribeImages(&ec2.DescribeImagesInput{
+		ImageIds: []*string{aws.String("ami-system123")},
+	}, "000000000001")
+	require.NoError(t, err)
+	require.Len(t, result.Images, 1)
+	assert.Equal(t, "000000000000", *result.Images[0].OwnerId) // System AMIs report global account
+
+	result2, err := svc.DescribeImages(&ec2.DescribeImagesInput{
+		ImageIds: []*string{aws.String("ami-system123")},
+	}, "000000000002")
+	require.NoError(t, err)
+	require.Len(t, result2.Images, 1)
+}
diff --git a/hive/handlers/ec2/image/service_nats.go b/hive/handlers/ec2/image/service_nats.go
index 307bf7253..b4733d3f8 100644
--- a/hive/handlers/ec2/image/service_nats.go
+++ b/hive/handlers/ec2/image/service_nats.go
@@ -19,34 +19,34 @@ func NewNATSImageService(conn *nats.Conn) ImageService {
 	return &NATSImageService{natsConn: conn}
 }
 
-func (s *NATSImageService) DescribeImages(input *ec2.DescribeImagesInput) (*ec2.DescribeImagesOutput, error) {
-	return utils.NATSRequest[ec2.DescribeImagesOutput](s.natsConn, "ec2.DescribeImages", input, 30*time.Second)
+func (s *NATSImageService) DescribeImages(input *ec2.DescribeImagesInput, accountID string) (*ec2.DescribeImagesOutput, error) {
+	return utils.NATSRequest[ec2.DescribeImagesOutput](s.natsConn, "ec2.DescribeImages", input, 30*time.Second, accountID)
 }
 
-func (s *NATSImageService) CreateImage(input *ec2.CreateImageInput) (*ec2.CreateImageOutput, error) {
-	return utils.NATSRequest[ec2.CreateImageOutput](s.natsConn, "ec2.CreateImage", input, 120*time.Second)
+func (s *NATSImageService) CreateImage(input *ec2.CreateImageInput, accountID string) (*ec2.CreateImageOutput, error) {
+	return utils.NATSRequest[ec2.CreateImageOutput](s.natsConn, "ec2.CreateImage", input, 120*time.Second, accountID)
 }
 
-func (s *NATSImageService) CopyImage(input *ec2.CopyImageInput) (*ec2.CopyImageOutput, error) {
+func (s *NATSImageService) CopyImage(input *ec2.CopyImageInput, accountID string) (*ec2.CopyImageOutput, error) {
 	return nil, errors.New("CopyImage not yet implemented")
 }
 
-func (s *NATSImageService) DescribeImageAttribute(input *ec2.DescribeImageAttributeInput) (*ec2.DescribeImageAttributeOutput, error) {
+func (s *NATSImageService) DescribeImageAttribute(input *ec2.DescribeImageAttributeInput, accountID string) (*ec2.DescribeImageAttributeOutput, error) {
 	return nil, errors.New("DescribeImageAttribute not yet implemented")
 }
 
-func (s *NATSImageService) RegisterImage(input *ec2.RegisterImageInput) (*ec2.RegisterImageOutput, error) {
+func (s *NATSImageService) RegisterImage(input *ec2.RegisterImageInput, accountID string) (*ec2.RegisterImageOutput, error) {
 	return nil, errors.New("RegisterImage not yet implemented")
 }
 
-func (s *NATSImageService) DeregisterImage(input *ec2.DeregisterImageInput) (*ec2.DeregisterImageOutput, error) {
+func (s *NATSImageService) DeregisterImage(input *ec2.DeregisterImageInput, accountID string) (*ec2.DeregisterImageOutput, error) {
 	return nil, errors.New("DeregisterImage not yet implemented")
 }
 
-func (s *NATSImageService) ModifyImageAttribute(input *ec2.ModifyImageAttributeInput) (*ec2.ModifyImageAttributeOutput, error) {
+func (s *NATSImageService) ModifyImageAttribute(input *ec2.ModifyImageAttributeInput, accountID string) (*ec2.ModifyImageAttributeOutput, error) {
 	return nil, errors.New("ModifyImageAttribute not yet implemented")
 }
 
-func (s *NATSImageService) ResetImageAttribute(input *ec2.ResetImageAttributeInput) (*ec2.ResetImageAttributeOutput, error) {
+func (s *NATSImageService) ResetImageAttribute(input *ec2.ResetImageAttributeInput, accountID string) (*ec2.ResetImageAttributeOutput, error) {
 	return nil, errors.New("ResetImageAttribute not yet implemented")
 }
diff --git a/hive/handlers/ec2/instance/service.go b/hive/handlers/ec2/instance/service.go
index 83bafe6ef..5af6caaf7 100644
--- a/hive/handlers/ec2/instance/service.go
+++ b/hive/handlers/ec2/instance/service.go
@@ -4,5 +4,5 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // InstanceService defines the interface for EC2 instance operations business logic
 type InstanceService interface {
-	RunInstances(input *ec2.RunInstancesInput) (*ec2.Reservation, error)
+	RunInstances(input *ec2.RunInstancesInput, accountID string) (*ec2.Reservation, error)
 }
diff --git a/hive/handlers/ec2/instance/service_impl.go b/hive/handlers/ec2/instance/service_impl.go
index aaf678b88..2638a6461 100644
--- a/hive/handlers/ec2/instance/service_impl.go
+++ b/hive/handlers/ec2/instance/service_impl.go
@@ -507,7 +507,7 @@ func (s *InstanceServiceImpl) prepareCloudInitVolume(input *ec2.RunInstancesInpu
 	}
 
 	// Create the cloud-init ISO
-	err = s.createCloudInitISO(input, instance.ID, cloudInitVb)
+	err = s.createCloudInitISO(input, instance.ID, instance.AccountID, cloudInitVb)
 	if err != nil {
 		return err
 	}
@@ -534,7 +534,7 @@ func (s *InstanceServiceImpl) prepareCloudInitVolume(input *ec2.RunInstancesInpu
 }
 
 // createCloudInitISO generates the cloud-init ISO image
-func (s *InstanceServiceImpl) createCloudInitISO(input *ec2.RunInstancesInput, instanceId string, cloudInitVb *viperblock.VB) error {
+func (s *InstanceServiceImpl) createCloudInitISO(input *ec2.RunInstancesInput, instanceId string, accountID string, cloudInitVb *viperblock.VB) error {
 	// Create ISO writer
 	writer, err := iso9660.NewWriter()
 	if err != nil {
@@ -552,8 +552,7 @@ func (s *InstanceServiceImpl) createCloudInitISO(input *ec2.RunInstancesInput, i
 		keyName = *input.KeyName
 	}
 
-	// TODO: Mock for account ID, replace with real account ID retrieval
-	keyPath := fmt.Sprintf("/keys/123456789/%s", keyName)
+	keyPath := fmt.Sprintf("keys/%s/%s", accountID, keyName)
 	result, err := s.objectStore.GetObject(&awss3.GetObjectInput{
 		Bucket: aws.String(s.config.Predastore.Bucket),
 		Key:    aws.String(keyPath),
diff --git a/hive/handlers/ec2/instance/service_mock.go b/hive/handlers/ec2/instance/service_mock.go
index 47410ce20..93fd5a0b5 100644
--- a/hive/handlers/ec2/instance/service_mock.go
+++ b/hive/handlers/ec2/instance/service_mock.go
@@ -13,7 +13,7 @@ func NewMockInstanceService() InstanceService {
 	return &MockInstanceService{}
 }
 
-func (s *MockInstanceService) RunInstances(input *ec2.RunInstancesInput) (*ec2.Reservation, error) {
+func (s *MockInstanceService) RunInstances(input *ec2.RunInstancesInput, accountID string) (*ec2.Reservation, error) {
 	instance := &ec2.Instance{
 		InstanceId: aws.String("i-0123456789abcdef0"),
 		State: &ec2.InstanceState{
@@ -28,7 +28,7 @@ func (s *MockInstanceService) RunInstances(input *ec2.RunInstancesInput) (*ec2.R
 
 	reservation := &ec2.Reservation{
 		Instances: []*ec2.Instance{instance},
-		OwnerId:   aws.String("123456789012"),
+		OwnerId:   aws.String(accountID),
 	}
 
 	return reservation, nil
diff --git a/hive/handlers/ec2/instance/service_nats.go b/hive/handlers/ec2/instance/service_nats.go
index 443c1a178..374d065ad 100644
--- a/hive/handlers/ec2/instance/service_nats.go
+++ b/hive/handlers/ec2/instance/service_nats.go
@@ -20,10 +20,10 @@ func NewNATSInstanceService(conn *nats.Conn) InstanceService {
 	return &NATSInstanceService{natsConn: conn}
 }
 
-func (s *NATSInstanceService) RunInstances(input *ec2.RunInstancesInput) (*ec2.Reservation, error) {
+func (s *NATSInstanceService) RunInstances(input *ec2.RunInstancesInput, accountID string) (*ec2.Reservation, error) {
 	if input == nil || input.InstanceType == nil {
 		return nil, fmt.Errorf("instance type is required")
 	}
 	topic := fmt.Sprintf("ec2.RunInstances.%s", aws.StringValue(input.InstanceType))
-	return utils.NATSRequest[ec2.Reservation](s.natsConn, topic, input, 5*time.Minute)
+	return utils.NATSRequest[ec2.Reservation](s.natsConn, topic, input, 5*time.Minute, accountID)
 }
diff --git a/hive/handlers/ec2/instance/service_nats_test.go b/hive/handlers/ec2/instance/service_nats_test.go
index 6f6b0c86b..06ef364f1 100644
--- a/hive/handlers/ec2/instance/service_nats_test.go
+++ b/hive/handlers/ec2/instance/service_nats_test.go
@@ -122,7 +122,7 @@ func TestNATSInstanceService_RunInstances_Success(t *testing.T) {
 	input := createValidRunInstancesInput()
 
 	// Call RunInstances
-	reservation, err := service.RunInstances(input)
+	reservation, err := service.RunInstances(input, "123456789012")
 
 	// Verify success
 	require.NoError(t, err, "RunInstances should succeed")
@@ -172,7 +172,7 @@ func TestNATSInstanceService_RunInstances_DaemonError(t *testing.T) {
 	}
 
 	// Call RunInstances
-	reservation, err := service.RunInstances(input)
+	reservation, err := service.RunInstances(input, "123456789012")
 
 	// Verify error handling - error should be just the AWS error code for gateway lookup
 	require.Error(t, err, "Should return error when daemon returns error")
@@ -200,7 +200,7 @@ func TestNATSInstanceService_RunInstances_NoSubscriber(t *testing.T) {
 
 	// Call RunInstances
 	start := time.Now()
-	reservation, err := service.RunInstances(input)
+	reservation, err := service.RunInstances(input, "123456789012")
 	duration := time.Since(start)
 
 	// Verify error behavior
@@ -237,7 +237,7 @@ func TestNATSInstanceService_RunInstances_InvalidResponse(t *testing.T) {
 	input := createValidRunInstancesInput()
 
 	// Call RunInstances
-	reservation, err := service.RunInstances(input)
+	reservation, err := service.RunInstances(input, "123456789012")
 
 	// Verify error handling
 	require.Error(t, err, "Should return error for invalid JSON")
@@ -261,7 +261,7 @@ func TestNATSInstanceService_RunInstances_MarshalError(t *testing.T) {
 	service := NewNATSInstanceService(nc)
 
 	// Nil input should be rejected before hitting NATS
-	reservation, err := service.RunInstances(nil)
+	reservation, err := service.RunInstances(nil, "123456789012")
 	require.Error(t, err, "Should handle nil input")
 	assert.Nil(t, reservation)
 	assert.Contains(t, err.Error(), "instance type is required")
@@ -318,7 +318,7 @@ func TestNATSInstanceService_RunInstances_MultipleInstances(t *testing.T) {
 	input.MinCount = aws.Int64(3)
 	input.MaxCount = aws.Int64(3)
 
-	reservation, err := service.RunInstances(input)
+	reservation, err := service.RunInstances(input, "123456789012")
 
 	// Verify multiple instances returned
 	require.NoError(t, err)
@@ -365,7 +365,7 @@ func TestNATSInstanceService_RunInstances_QueueGroup(t *testing.T) {
 	// Send multiple requests
 	requestCount := 10
 	for range requestCount {
-		reservation, err := service.RunInstances(input)
+		reservation, err := service.RunInstances(input, "123456789012")
 		require.NoError(t, err)
 		require.NotNil(t, reservation)
 	}
diff --git a/hive/handlers/ec2/key/service.go b/hive/handlers/ec2/key/service.go
index 219fe31de..55811025f 100644
--- a/hive/handlers/ec2/key/service.go
+++ b/hive/handlers/ec2/key/service.go
@@ -4,8 +4,8 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // KeyService defines the interface for EC2 key pair operations business logic
 type KeyService interface {
-	CreateKeyPair(input *ec2.CreateKeyPairInput) (*ec2.CreateKeyPairOutput, error)
-	DeleteKeyPair(input *ec2.DeleteKeyPairInput) (*ec2.DeleteKeyPairOutput, error)
-	DescribeKeyPairs(input *ec2.DescribeKeyPairsInput) (*ec2.DescribeKeyPairsOutput, error)
-	ImportKeyPair(input *ec2.ImportKeyPairInput) (*ec2.ImportKeyPairOutput, error)
+	CreateKeyPair(input *ec2.CreateKeyPairInput, accountID string) (*ec2.CreateKeyPairOutput, error)
+	DeleteKeyPair(input *ec2.DeleteKeyPairInput, accountID string) (*ec2.DeleteKeyPairOutput, error)
+	DescribeKeyPairs(input *ec2.DescribeKeyPairsInput, accountID string) (*ec2.DescribeKeyPairsOutput, error)
+	ImportKeyPair(input *ec2.ImportKeyPairInput, accountID string) (*ec2.ImportKeyPairOutput, error)
 }
diff --git a/hive/handlers/ec2/key/service_impl.go b/hive/handlers/ec2/key/service_impl.go
index 6c049f9b7..4d4533cbe 100644
--- a/hive/handlers/ec2/key/service_impl.go
+++ b/hive/handlers/ec2/key/service_impl.go
@@ -33,7 +33,6 @@ type KeyServiceImpl struct {
 	config     *config.Config
 	store      objectstore.ObjectStore
 	bucketName string
-	accountID  string // AWS account ID for S3 key storage path
 }
 
 // NewKeyServiceImpl creates a new daemon-side key service
@@ -49,21 +48,19 @@ func NewKeyServiceImpl(cfg *config.Config) *KeyServiceImpl {
 		config:     cfg,
 		store:      store,
 		bucketName: cfg.Predastore.Bucket,
-		accountID:  "123456789", // TODO: Implement proper account ID management
 	}
 }
 
 // NewKeyServiceImplWithStore creates a key service with a custom object store (for testing)
-func NewKeyServiceImplWithStore(store objectstore.ObjectStore, bucketName, accountID string) *KeyServiceImpl {
+func NewKeyServiceImplWithStore(store objectstore.ObjectStore, bucketName string) *KeyServiceImpl {
 	return &KeyServiceImpl{
 		store:      store,
 		bucketName: bucketName,
-		accountID:  accountID,
 	}
 }
 
 // CreateKeyPair generates a new SSH key pair using ssh-keygen
-func (s *KeyServiceImpl) CreateKeyPair(input *ec2.CreateKeyPairInput) (*ec2.CreateKeyPairOutput, error) {
+func (s *KeyServiceImpl) CreateKeyPair(input *ec2.CreateKeyPairInput, accountID string) (*ec2.CreateKeyPairOutput, error) {
 	if input == nil || input.KeyName == nil {
 		return nil, errors.New(awserrors.ErrorMissingParameter)
 	}
@@ -78,7 +75,7 @@ func (s *KeyServiceImpl) CreateKeyPair(input *ec2.CreateKeyPairInput) (*ec2.Crea
 	}
 
 	// Check if key already exists in S3
-	keyPath := fmt.Sprintf("keys/%s/%s", s.accountID, keyName)
+	keyPath := fmt.Sprintf("keys/%s/%s", accountID, keyName)
 	_, err := s.store.GetObject(&s3.GetObjectInput{
 		Bucket: aws.String(s.bucketName),
 		Key:    aws.String(keyPath),
@@ -174,7 +171,7 @@ func (s *KeyServiceImpl) CreateKeyPair(input *ec2.CreateKeyPairInput) (*ec2.Crea
 	}
 
 	// Store metadata file (CreateKeyPairOutput without KeyMaterial) for keyPairId lookups
-	err = s.storeKeyPairMetadata(keyPairID, &ec2.CreateKeyPairOutput{
+	err = s.storeKeyPairMetadata(accountID, keyPairID, &ec2.CreateKeyPairOutput{
 		KeyFingerprint: aws.String(fingerprint),
 		KeyName:        aws.String(keyName),
 		KeyPairId:      aws.String(keyPairID),
@@ -237,9 +234,9 @@ func formatFingerprint(hash []byte, algorithm string) string {
 }
 
 // storeKeyPairMetadata stores key pair metadata (without private key) to S3 for keyPairId lookups
-func (s *KeyServiceImpl) storeKeyPairMetadata(keyPairID string, metadata *ec2.CreateKeyPairOutput) error {
+func (s *KeyServiceImpl) storeKeyPairMetadata(accountID, keyPairID string, metadata *ec2.CreateKeyPairOutput) error {
 	// Store metadata with keyPairId as filename for efficient lookup when keyPairId is provided
-	metadataPath := fmt.Sprintf("keys/%s/%s.json", s.accountID, keyPairID)
+	metadataPath := fmt.Sprintf("keys/%s/%s.json", accountID, keyPairID)
 
 	// Marshal metadata to JSON
 	jsonData, err := json.Marshal(metadata)
@@ -261,8 +258,8 @@ func (s *KeyServiceImpl) storeKeyPairMetadata(keyPairID string, metadata *ec2.Cr
 }
 
 // getKeyNameFromKeyPairId retrieves the key name by directly reading the metadata file for a given keyPairId
-func (s *KeyServiceImpl) getKeyNameFromKeyPairId(keyPairID string) (string, error) {
-	metadataPath := fmt.Sprintf("keys/%s/%s.json", s.accountID, keyPairID)
+func (s *KeyServiceImpl) getKeyNameFromKeyPairId(accountID, keyPairID string) (string, error) {
+	metadataPath := fmt.Sprintf("keys/%s/%s.json", accountID, keyPairID)
 
 	// Get metadata from S3
 	result, err := s.store.GetObject(&s3.GetObjectInput{
@@ -300,8 +297,8 @@ func (s *KeyServiceImpl) getKeyNameFromKeyPairId(keyPairID string) (string, erro
 }
 
 // findKeyPairIdFromKeyName finds the keyPairId by searching metadata files for a given keyName
-func (s *KeyServiceImpl) findKeyPairIdFromKeyName(keyName string) (string, error) {
-	prefix := fmt.Sprintf("keys/%s/", s.accountID)
+func (s *KeyServiceImpl) findKeyPairIdFromKeyName(accountID, keyName string) (string, error) {
+	prefix := fmt.Sprintf("keys/%s/", accountID)
 
 	// List all objects with the keys prefix
 	result, err := s.store.ListObjects(&s3.ListObjectsInput{
@@ -364,13 +361,13 @@ func (s *KeyServiceImpl) findKeyPairIdFromKeyName(keyName string) (string, error
 
 // ValidateKeyPairExists checks if a key pair with the given name exists.
 // Returns nil if the key pair exists, or an error with ErrorInvalidKeyPairNotFound if not.
-func (s *KeyServiceImpl) ValidateKeyPairExists(keyName string) error {
-	_, err := s.findKeyPairIdFromKeyName(keyName)
+func (s *KeyServiceImpl) ValidateKeyPairExists(accountID, keyName string) error {
+	_, err := s.findKeyPairIdFromKeyName(accountID, keyName)
 	return err
 }
 
 // DeleteKeyPair removes a key pair (both public key and metadata from S3)
-func (s *KeyServiceImpl) DeleteKeyPair(input *ec2.DeleteKeyPairInput) (*ec2.DeleteKeyPairOutput, error) {
+func (s *KeyServiceImpl) DeleteKeyPair(input *ec2.DeleteKeyPairInput, accountID string) (*ec2.DeleteKeyPairOutput, error) {
 	if input == nil {
 		return nil, errors.New(awserrors.ErrorMissingParameter)
 	}
@@ -391,7 +388,7 @@ func (s *KeyServiceImpl) DeleteKeyPair(input *ec2.DeleteKeyPairInput) (*ec2.Dele
 			return nil, errors.New(awserrors.ErrorInvalidKeyPairFormat)
 		}
 
-		keyName, err = s.getKeyNameFromKeyPairId(keyPairID)
+		keyName, err = s.getKeyNameFromKeyPairId(accountID, keyPairID)
 		if err != nil {
 			// AWS DeleteKeyPair is idempotent — return success for non-existent keys
 			if err.Error() == awserrors.ErrorInvalidKeyPairNotFound {
@@ -411,7 +408,7 @@ func (s *KeyServiceImpl) DeleteKeyPair(input *ec2.DeleteKeyPairInput) (*ec2.Dele
 			return nil, errors.New(awserrors.ErrorInvalidKeyPairFormat)
 		}
 
-		keyPairID, err = s.findKeyPairIdFromKeyName(keyName)
+		keyPairID, err = s.findKeyPairIdFromKeyName(accountID, keyName)
 		if err != nil {
 			// AWS DeleteKeyPair is idempotent — return success for non-existent keys
 			if err.Error() == awserrors.ErrorInvalidKeyPairNotFound {
@@ -428,7 +425,7 @@ func (s *KeyServiceImpl) DeleteKeyPair(input *ec2.DeleteKeyPairInput) (*ec2.Dele
 	slog.Info("Deleting key pair", "keyName", keyName, "keyPairId", keyPairID)
 
 	// Delete public key
-	publicKeyPath := fmt.Sprintf("keys/%s/%s", s.accountID, keyName)
+	publicKeyPath := fmt.Sprintf("keys/%s/%s", accountID, keyName)
 	_, err = s.store.DeleteObject(&s3.DeleteObjectInput{
 		Bucket: aws.String(s.bucketName),
 		Key:    aws.String(publicKeyPath),
@@ -439,7 +436,7 @@ func (s *KeyServiceImpl) DeleteKeyPair(input *ec2.DeleteKeyPairInput) (*ec2.Dele
 	}
 
 	// Delete metadata file (stored with keyPairID)
-	metadataPath := fmt.Sprintf("keys/%s/%s.json", s.accountID, keyPairID)
+	metadataPath := fmt.Sprintf("keys/%s/%s.json", accountID, keyPairID)
 	_, err = s.store.DeleteObject(&s3.DeleteObjectInput{
 		Bucket: aws.String(s.bucketName),
 		Key:    aws.String(metadataPath),
@@ -455,14 +452,14 @@ func (s *KeyServiceImpl) DeleteKeyPair(input *ec2.DeleteKeyPairInput) (*ec2.Dele
 }
 
 // DescribeKeyPairs lists available key pairs by reading metadata files from S3
-func (s *KeyServiceImpl) DescribeKeyPairs(input *ec2.DescribeKeyPairsInput) (*ec2.DescribeKeyPairsOutput, error) {
+func (s *KeyServiceImpl) DescribeKeyPairs(input *ec2.DescribeKeyPairsInput, accountID string) (*ec2.DescribeKeyPairsOutput, error) {
 	if input == nil {
 		input = &ec2.DescribeKeyPairsInput{}
 	}
 
 	slog.Info("Describing key pairs", "filters", input.Filters)
 
-	prefix := fmt.Sprintf("keys/%s/", s.accountID)
+	prefix := fmt.Sprintf("keys/%s/", accountID)
 
 	// List all objects with the keys prefix
 	result, err := s.store.ListObjects(&s3.ListObjectsInput{
@@ -574,7 +571,7 @@ func (s *KeyServiceImpl) DescribeKeyPairs(input *ec2.DescribeKeyPairsInput) (*ec
 }
 
 // ImportKeyPair imports an existing public key
-func (s *KeyServiceImpl) ImportKeyPair(input *ec2.ImportKeyPairInput) (*ec2.ImportKeyPairOutput, error) {
+func (s *KeyServiceImpl) ImportKeyPair(input *ec2.ImportKeyPairInput, accountID string) (*ec2.ImportKeyPairOutput, error) {
 	if input == nil || input.KeyName == nil {
 		return nil, errors.New(awserrors.ErrorMissingParameter)
 	}
@@ -593,7 +590,7 @@ func (s *KeyServiceImpl) ImportKeyPair(input *ec2.ImportKeyPairInput) (*ec2.Impo
 	}
 
 	// Check if key already exists in S3
-	keyPath := fmt.Sprintf("keys/%s/%s", s.accountID, keyName)
+	keyPath := fmt.Sprintf("keys/%s/%s", accountID, keyName)
 	_, err := s.store.GetObject(&s3.GetObjectInput{
 		Bucket: aws.String(s.bucketName),
 		Key:    aws.String(keyPath),
@@ -674,7 +671,7 @@ func (s *KeyServiceImpl) ImportKeyPair(input *ec2.ImportKeyPairInput) (*ec2.Impo
 		KeyPairId:      aws.String(keyPairID),
 	}
 
-	err = s.storeKeyPairMetadata(keyPairID, metadataOutput)
+	err = s.storeKeyPairMetadata(accountID, keyPairID, metadataOutput)
 	if err != nil {
 		slog.Error("Failed to store key pair metadata", "err", err, "keyPairId", keyPairID)
 		// Try to cleanup the public key we just uploaded
diff --git a/hive/handlers/ec2/key/service_impl_test.go b/hive/handlers/ec2/key/service_impl_test.go
index 17f29c1cf..a483a8ba7 100644
--- a/hive/handlers/ec2/key/service_impl_test.go
+++ b/hive/handlers/ec2/key/service_impl_test.go
@@ -28,7 +28,7 @@ const testRSAPubKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDP9LrByKWpgbX+prxBw
 
 func newTestKeyService() (*KeyServiceImpl, *objectstore.MemoryObjectStore) {
 	store := objectstore.NewMemoryObjectStore()
-	svc := NewKeyServiceImplWithStore(store, testBucket, testAccountID)
+	svc := NewKeyServiceImplWithStore(store, testBucket)
 	return svc, store
 }
 
@@ -46,7 +46,7 @@ func importTestKey(t *testing.T, svc *KeyServiceImpl, keyName string) *ec2.Impor
 	out, err := svc.ImportKeyPair(&ec2.ImportKeyPairInput{
 		KeyName:           aws.String(keyName),
 		PublicKeyMaterial: []byte(testED25519PubKey),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 	return out
@@ -83,7 +83,7 @@ func TestCreateKeyPair_ED25519(t *testing.T) {
 
 	out, err := svc.CreateKeyPair(&ec2.CreateKeyPairInput{
 		KeyName: aws.String("my-ed25519-key"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 
@@ -121,7 +121,7 @@ func TestCreateKeyPair_RSA(t *testing.T) {
 	out, err := svc.CreateKeyPair(&ec2.CreateKeyPairInput{
 		KeyName: aws.String("my-rsa-key"),
 		KeyType: aws.String("rsa"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 
@@ -134,7 +134,7 @@ func TestCreateKeyPair_RSA(t *testing.T) {
 func TestCreateKeyPair_NilInput(t *testing.T) {
 	svc, _ := newTestKeyService()
 
-	out, err := svc.CreateKeyPair(nil)
+	out, err := svc.CreateKeyPair(nil, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, out)
 	assert.Equal(t, awserrors.ErrorMissingParameter, err.Error())
@@ -143,7 +143,7 @@ func TestCreateKeyPair_NilInput(t *testing.T) {
 func TestCreateKeyPair_MissingKeyName(t *testing.T) {
 	svc, _ := newTestKeyService()
 
-	out, err := svc.CreateKeyPair(&ec2.CreateKeyPairInput{})
+	out, err := svc.CreateKeyPair(&ec2.CreateKeyPairInput{}, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, out)
 	assert.Equal(t, awserrors.ErrorMissingParameter, err.Error())
@@ -154,7 +154,7 @@ func TestCreateKeyPair_InvalidKeyName(t *testing.T) {
 
 	out, err := svc.CreateKeyPair(&ec2.CreateKeyPairInput{
 		KeyName: aws.String("invalid key name!@#"),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, out)
 	assert.Equal(t, awserrors.ErrorInvalidKeyPairFormat, err.Error())
@@ -166,12 +166,12 @@ func TestCreateKeyPair_Duplicate(t *testing.T) {
 
 	_, err := svc.CreateKeyPair(&ec2.CreateKeyPairInput{
 		KeyName: aws.String("dup-key"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	out, err := svc.CreateKeyPair(&ec2.CreateKeyPairInput{
 		KeyName: aws.String("dup-key"),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, out)
 	assert.Equal(t, awserrors.ErrorInvalidKeyPairDuplicate, err.Error())
@@ -183,7 +183,7 @@ func TestCreateKeyPair_InvalidKeyType(t *testing.T) {
 	out, err := svc.CreateKeyPair(&ec2.CreateKeyPairInput{
 		KeyName: aws.String("bad-type-key"),
 		KeyType: aws.String("dsa"),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, out)
 	assert.Equal(t, awserrors.ErrorInvalidParameterValue, err.Error())
@@ -199,7 +199,7 @@ func TestImportKeyPair_Success_ED25519(t *testing.T) {
 	out, err := svc.ImportKeyPair(&ec2.ImportKeyPairInput{
 		KeyName:           aws.String("imported-ed25519"),
 		PublicKeyMaterial: []byte(testED25519PubKey),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 
@@ -234,7 +234,7 @@ func TestImportKeyPair_Success_RSA(t *testing.T) {
 	out, err := svc.ImportKeyPair(&ec2.ImportKeyPairInput{
 		KeyName:           aws.String("imported-rsa"),
 		PublicKeyMaterial: []byte(testRSAPubKey),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 
@@ -249,13 +249,13 @@ func TestImportKeyPair_Duplicate(t *testing.T) {
 	_, err := svc.ImportKeyPair(&ec2.ImportKeyPairInput{
 		KeyName:           aws.String("dup-import"),
 		PublicKeyMaterial: []byte(testED25519PubKey),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	out, err := svc.ImportKeyPair(&ec2.ImportKeyPairInput{
 		KeyName:           aws.String("dup-import"),
 		PublicKeyMaterial: []byte(testED25519PubKey),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, out)
 	assert.Equal(t, awserrors.ErrorInvalidKeyPairDuplicate, err.Error())
@@ -267,7 +267,7 @@ func TestImportKeyPair_InvalidKeyName(t *testing.T) {
 	out, err := svc.ImportKeyPair(&ec2.ImportKeyPairInput{
 		KeyName:           aws.String("bad name with spaces!"),
 		PublicKeyMaterial: []byte(testED25519PubKey),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, out)
 	assert.Equal(t, awserrors.ErrorInvalidKeyPairFormat, err.Error())
@@ -308,7 +308,7 @@ func TestImportKeyPairInvalidKeyFormat(t *testing.T) {
 			_, err := svc.ImportKeyPair(&ec2.ImportKeyPairInput{
 				KeyName:           aws.String("test-key"),
 				PublicKeyMaterial: []byte(tt.publicKey),
-			})
+			}, testAccountID)
 			require.Error(t, err)
 			assert.Equal(t, tt.expectedErrMsg, err.Error())
 		})
@@ -326,7 +326,7 @@ func TestDeleteKeyPair_ByKeyName(t *testing.T) {
 
 	result, err := svc.DeleteKeyPair(&ec2.DeleteKeyPairInput{
 		KeyName: aws.String("to-delete-by-name"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.NotNil(t, result)
 
@@ -354,7 +354,7 @@ func TestDeleteKeyPair_ByKeyPairId(t *testing.T) {
 
 	result, err := svc.DeleteKeyPair(&ec2.DeleteKeyPairInput{
 		KeyPairId: imported.KeyPairId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.NotNil(t, result)
 
@@ -381,7 +381,7 @@ func TestDeleteKeyPairIdempotent(t *testing.T) {
 	t.Run("NonExistentKeyName", func(t *testing.T) {
 		result, err := svc.DeleteKeyPair(&ec2.DeleteKeyPairInput{
 			KeyName: aws.String("no-such-key"),
-		})
+		}, testAccountID)
 		require.NoError(t, err)
 		assert.NotNil(t, result)
 	})
@@ -389,7 +389,7 @@ func TestDeleteKeyPairIdempotent(t *testing.T) {
 	t.Run("NonExistentKeyPairId", func(t *testing.T) {
 		result, err := svc.DeleteKeyPair(&ec2.DeleteKeyPairInput{
 			KeyPairId: aws.String("key-0123456789abcdef0"),
-		})
+		}, testAccountID)
 		require.NoError(t, err)
 		assert.NotNil(t, result)
 	})
@@ -398,7 +398,7 @@ func TestDeleteKeyPairIdempotent(t *testing.T) {
 func TestDeleteKeyPair_NilInput(t *testing.T) {
 	svc, _ := newTestKeyService()
 
-	result, err := svc.DeleteKeyPair(nil)
+	result, err := svc.DeleteKeyPair(nil, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, result)
 	assert.Equal(t, awserrors.ErrorMissingParameter, err.Error())
@@ -407,7 +407,7 @@ func TestDeleteKeyPair_NilInput(t *testing.T) {
 func TestDeleteKeyPair_EmptyNameAndId(t *testing.T) {
 	svc, _ := newTestKeyService()
 
-	result, err := svc.DeleteKeyPair(&ec2.DeleteKeyPairInput{})
+	result, err := svc.DeleteKeyPair(&ec2.DeleteKeyPairInput{}, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, result)
 	assert.Equal(t, awserrors.ErrorMissingParameter, err.Error())
@@ -418,7 +418,7 @@ func TestDeleteKeyPair_InvalidKeyPairIdFormat(t *testing.T) {
 
 	result, err := svc.DeleteKeyPair(&ec2.DeleteKeyPairInput{
 		KeyPairId: aws.String("bad id format!!!"),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Nil(t, result)
 	assert.Equal(t, awserrors.ErrorInvalidKeyPairFormat, err.Error())
@@ -431,7 +431,7 @@ func TestDeleteKeyPair_InvalidKeyPairIdFormat(t *testing.T) {
 func TestDescribeKeyPairs_Empty(t *testing.T) {
 	svc, _ := newTestKeyService()
 
-	out, err := svc.DescribeKeyPairs(&ec2.DescribeKeyPairsInput{})
+	out, err := svc.DescribeKeyPairs(&ec2.DescribeKeyPairsInput{}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 	assert.Empty(t, out.KeyPairs)
@@ -443,7 +443,7 @@ func TestDescribeKeyPairs_AllKeys(t *testing.T) {
 	importTestKey(t, svc, "key-alpha")
 	importTestKey(t, svc, "key-beta")
 
-	out, err := svc.DescribeKeyPairs(&ec2.DescribeKeyPairsInput{})
+	out, err := svc.DescribeKeyPairs(&ec2.DescribeKeyPairsInput{}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 	assert.Len(t, out.KeyPairs, 2)
@@ -467,7 +467,7 @@ func TestDescribeKeyPairs_FilterByKeyName(t *testing.T) {
 
 	out, err := svc.DescribeKeyPairs(&ec2.DescribeKeyPairsInput{
 		KeyNames: []*string{aws.String("find-me")},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 	require.Len(t, out.KeyPairs, 1)
@@ -482,7 +482,7 @@ func TestDescribeKeyPairs_FilterByKeyPairId(t *testing.T) {
 
 	out, err := svc.DescribeKeyPairs(&ec2.DescribeKeyPairsInput{
 		KeyPairIds: []*string{imported.KeyPairId},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 	require.Len(t, out.KeyPairs, 1)
@@ -496,7 +496,7 @@ func TestDescribeKeyPairs_FilterNoMatch(t *testing.T) {
 
 	out, err := svc.DescribeKeyPairs(&ec2.DescribeKeyPairsInput{
 		KeyNames: []*string{aws.String("does-not-exist")},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 	assert.Empty(t, out.KeyPairs)
@@ -505,7 +505,7 @@ func TestDescribeKeyPairs_FilterNoMatch(t *testing.T) {
 func TestDescribeKeyPairs_NilInput(t *testing.T) {
 	svc, _ := newTestKeyService()
 
-	out, err := svc.DescribeKeyPairs(nil)
+	out, err := svc.DescribeKeyPairs(nil, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out)
 	assert.Empty(t, out.KeyPairs)
@@ -520,14 +520,14 @@ func TestValidateKeyPairExists_Found(t *testing.T) {
 
 	importTestKey(t, svc, "existing-key")
 
-	err := svc.ValidateKeyPairExists("existing-key")
+	err := svc.ValidateKeyPairExists(testAccountID, "existing-key")
 	assert.NoError(t, err)
 }
 
 func TestValidateKeyPairExists_NotFound(t *testing.T) {
 	svc, _ := newTestKeyService()
 
-	err := svc.ValidateKeyPairExists("ghost-key")
+	err := svc.ValidateKeyPairExists(testAccountID, "ghost-key")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidKeyPairNotFound, err.Error())
 }
diff --git a/hive/handlers/ec2/key/service_mock.go b/hive/handlers/ec2/key/service_mock.go
index 401fb0342..64bd1b5c8 100644
--- a/hive/handlers/ec2/key/service_mock.go
+++ b/hive/handlers/ec2/key/service_mock.go
@@ -13,7 +13,7 @@ func NewMockKeyService() KeyService {
 	return &MockKeyService{}
 }
 
-func (s *MockKeyService) CreateKeyPair(input *ec2.CreateKeyPairInput) (*ec2.CreateKeyPairOutput, error) {
+func (s *MockKeyService) CreateKeyPair(input *ec2.CreateKeyPairInput, accountID string) (*ec2.CreateKeyPairOutput, error) {
 	return &ec2.CreateKeyPairOutput{
 		KeyFingerprint: aws.String("1f:51:ae:28:bf:89:e9:d8:1f:25:5d:37:2d:7d:b8:ca:9f:f5:f1:6f"),
 		KeyMaterial:    aws.String("-----BEGIN RSA PRIVATE KEY-----\nMIIEpQIBAAKCAQEA...\n-----END RSA PRIVATE KEY-----"),
@@ -22,14 +22,14 @@ func (s *MockKeyService) CreateKeyPair(input *ec2.CreateKeyPairInput) (*ec2.Crea
 	}, nil
 }
 
-func (s *MockKeyService) DeleteKeyPair(input *ec2.DeleteKeyPairInput) (*ec2.DeleteKeyPairOutput, error) {
+func (s *MockKeyService) DeleteKeyPair(input *ec2.DeleteKeyPairInput, accountID string) (*ec2.DeleteKeyPairOutput, error) {
 	return &ec2.DeleteKeyPairOutput{
 		Return:    aws.Bool(true),
 		KeyPairId: input.KeyPairId,
 	}, nil
 }
 
-func (s *MockKeyService) DescribeKeyPairs(input *ec2.DescribeKeyPairsInput) (*ec2.DescribeKeyPairsOutput, error) {
+func (s *MockKeyService) DescribeKeyPairs(input *ec2.DescribeKeyPairsInput, accountID string) (*ec2.DescribeKeyPairsOutput, error) {
 	return &ec2.DescribeKeyPairsOutput{
 		KeyPairs: []*ec2.KeyPairInfo{
 			{
@@ -42,7 +42,7 @@ func (s *MockKeyService) DescribeKeyPairs(input *ec2.DescribeKeyPairsInput) (*ec
 	}, nil
 }
 
-func (s *MockKeyService) ImportKeyPair(input *ec2.ImportKeyPairInput) (*ec2.ImportKeyPairOutput, error) {
+func (s *MockKeyService) ImportKeyPair(input *ec2.ImportKeyPairInput, accountID string) (*ec2.ImportKeyPairOutput, error) {
 	return &ec2.ImportKeyPairOutput{
 		KeyFingerprint: aws.String("1f:51:ae:28:bf:89:e9:d8:1f:25:5d:37:2d:7d:b8:ca:9f:f5:f1:6f"),
 		KeyName:        input.KeyName,
diff --git a/hive/handlers/ec2/key/service_nats.go b/hive/handlers/ec2/key/service_nats.go
index 96a6cd779..bdb2e113d 100644
--- a/hive/handlers/ec2/key/service_nats.go
+++ b/hive/handlers/ec2/key/service_nats.go
@@ -18,18 +18,18 @@ func NewNATSKeyService(conn *nats.Conn) KeyService {
 	return &NATSKeyService{natsConn: conn}
 }
 
-func (s *NATSKeyService) CreateKeyPair(input *ec2.CreateKeyPairInput) (*ec2.CreateKeyPairOutput, error) {
-	return utils.NATSRequest[ec2.CreateKeyPairOutput](s.natsConn, "ec2.CreateKeyPair", input, 30*time.Second)
+func (s *NATSKeyService) CreateKeyPair(input *ec2.CreateKeyPairInput, accountID string) (*ec2.CreateKeyPairOutput, error) {
+	return utils.NATSRequest[ec2.CreateKeyPairOutput](s.natsConn, "ec2.CreateKeyPair", input, 30*time.Second, accountID)
 }
 
-func (s *NATSKeyService) DeleteKeyPair(input *ec2.DeleteKeyPairInput) (*ec2.DeleteKeyPairOutput, error) {
-	return utils.NATSRequest[ec2.DeleteKeyPairOutput](s.natsConn, "ec2.DeleteKeyPair", input, 30*time.Second)
+func (s *NATSKeyService) DeleteKeyPair(input *ec2.DeleteKeyPairInput, accountID string) (*ec2.DeleteKeyPairOutput, error) {
+	return utils.NATSRequest[ec2.DeleteKeyPairOutput](s.natsConn, "ec2.DeleteKeyPair", input, 30*time.Second, accountID)
 }
 
-func (s *NATSKeyService) DescribeKeyPairs(input *ec2.DescribeKeyPairsInput) (*ec2.DescribeKeyPairsOutput, error) {
-	return utils.NATSRequest[ec2.DescribeKeyPairsOutput](s.natsConn, "ec2.DescribeKeyPairs", input, 30*time.Second)
+func (s *NATSKeyService) DescribeKeyPairs(input *ec2.DescribeKeyPairsInput, accountID string) (*ec2.DescribeKeyPairsOutput, error) {
+	return utils.NATSRequest[ec2.DescribeKeyPairsOutput](s.natsConn, "ec2.DescribeKeyPairs", input, 30*time.Second, accountID)
 }
 
-func (s *NATSKeyService) ImportKeyPair(input *ec2.ImportKeyPairInput) (*ec2.ImportKeyPairOutput, error) {
-	return utils.NATSRequest[ec2.ImportKeyPairOutput](s.natsConn, "ec2.ImportKeyPair", input, 30*time.Second)
+func (s *NATSKeyService) ImportKeyPair(input *ec2.ImportKeyPairInput, accountID string) (*ec2.ImportKeyPairOutput, error) {
+	return utils.NATSRequest[ec2.ImportKeyPairOutput](s.natsConn, "ec2.ImportKeyPair", input, 30*time.Second, accountID)
 }
diff --git a/hive/handlers/ec2/snapshot/service.go b/hive/handlers/ec2/snapshot/service.go
index 529ab88b4..4ea47abce 100644
--- a/hive/handlers/ec2/snapshot/service.go
+++ b/hive/handlers/ec2/snapshot/service.go
@@ -4,8 +4,8 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // SnapshotService defines the interface for EC2 snapshot operations
 type SnapshotService interface {
-	CreateSnapshot(input *ec2.CreateSnapshotInput) (*ec2.Snapshot, error)
-	DescribeSnapshots(input *ec2.DescribeSnapshotsInput) (*ec2.DescribeSnapshotsOutput, error)
-	DeleteSnapshot(input *ec2.DeleteSnapshotInput) (*ec2.DeleteSnapshotOutput, error)
-	CopySnapshot(input *ec2.CopySnapshotInput) (*ec2.CopySnapshotOutput, error)
+	CreateSnapshot(input *ec2.CreateSnapshotInput, accountID string) (*ec2.Snapshot, error)
+	DescribeSnapshots(input *ec2.DescribeSnapshotsInput, accountID string) (*ec2.DescribeSnapshotsOutput, error)
+	DeleteSnapshot(input *ec2.DeleteSnapshotInput, accountID string) (*ec2.DeleteSnapshotOutput, error)
+	CopySnapshot(input *ec2.CopySnapshotInput, accountID string) (*ec2.CopySnapshotOutput, error)
 }
diff --git a/hive/handlers/ec2/snapshot/service_impl.go b/hive/handlers/ec2/snapshot/service_impl.go
index 96175d4f4..bd3ff9285 100644
--- a/hive/handlers/ec2/snapshot/service_impl.go
+++ b/hive/handlers/ec2/snapshot/service_impl.go
@@ -187,7 +187,7 @@ func snapshotConfigToEC2(cfg *SnapshotConfig) *ec2.Snapshot {
 }
 
 // CreateSnapshot creates a new snapshot from a volume
-func (s *SnapshotServiceImpl) CreateSnapshot(input *ec2.CreateSnapshotInput) (*ec2.Snapshot, error) {
+func (s *SnapshotServiceImpl) CreateSnapshot(input *ec2.CreateSnapshotInput, accountID string) (*ec2.Snapshot, error) {
 	if input == nil || input.VolumeId == nil {
 		return nil, errors.New(awserrors.ErrorInvalidParameterValue)
 	}
@@ -216,6 +216,12 @@ func (s *SnapshotServiceImpl) CreateSnapshot(input *ec2.CreateSnapshotInput) (*e
 	}
 	volumeConfig := volumeState.VolumeConfig
 
+	// Verify the caller owns the source volume
+	if accountID != "" && volumeConfig.VolumeMetadata.TenantID != "" && volumeConfig.VolumeMetadata.TenantID != accountID {
+		slog.Warn("CreateSnapshot: account does not own volume", "volumeId", volumeID, "accountID", accountID, "tenantID", volumeConfig.VolumeMetadata.TenantID)
+		return nil, errors.New(awserrors.ErrorInvalidVolumeNotFound)
+	}
+
 	if volumeConfig.VolumeMetadata.SizeGiB == 0 {
 		slog.Error("CreateSnapshot: source volume has zero size in config", "volumeId", volumeID)
 		return nil, errors.New(awserrors.ErrorServerInternal)
@@ -266,7 +272,7 @@ func (s *SnapshotServiceImpl) CreateSnapshot(input *ec2.CreateSnapshotInput) (*e
 		Progress:         "100%",
 		StartTime:        now,
 		Encrypted:        volumeConfig.VolumeMetadata.IsEncrypted,
-		OwnerID:          s.config.Predastore.AccessKey,
+		OwnerID:          accountID,
 		AvailabilityZone: volumeConfig.VolumeMetadata.AvailabilityZone,
 		Tags:             make(map[string]string),
 	}
@@ -303,12 +309,12 @@ func (s *SnapshotServiceImpl) CreateSnapshot(input *ec2.CreateSnapshotInput) (*e
 	return snapshotConfigToEC2(snapshotCfg), nil
 }
 
-// DescribeSnapshots lists snapshots matching the specified criteria
-func (s *SnapshotServiceImpl) DescribeSnapshots(input *ec2.DescribeSnapshotsInput) (*ec2.DescribeSnapshotsOutput, error) {
+// DescribeSnapshots lists snapshots matching the specified criteria, scoped to the caller's account.
+func (s *SnapshotServiceImpl) DescribeSnapshots(input *ec2.DescribeSnapshotsInput, accountID string) (*ec2.DescribeSnapshotsOutput, error) {
 	s.mutex.RLock()
 	defer s.mutex.RUnlock()
 
-	slog.Info("DescribeSnapshots request", "snapshotIds", input.SnapshotIds)
+	slog.Info("DescribeSnapshots request", "snapshotIds", input.SnapshotIds, "accountID", accountID)
 
 	snapshotIDFilter := make(map[string]bool)
 	for _, id := range input.SnapshotIds {
@@ -345,6 +351,11 @@ func (s *SnapshotServiceImpl) DescribeSnapshots(input *ec2.DescribeSnapshotsInpu
 			continue
 		}
 
+		// Filter by account: only return snapshots owned by the caller
+		if accountID != "" && cfg.OwnerID != "" && cfg.OwnerID != accountID {
+			continue
+		}
+
 		snapshots = append(snapshots, snapshotConfigToEC2(cfg))
 	}
 
@@ -396,15 +407,15 @@ func (s *SnapshotServiceImpl) snapshotInUseByVolumes(snapshotID string) (bool, e
 	return false, nil
 }
 
-// DeleteSnapshot deletes a snapshot
-func (s *SnapshotServiceImpl) DeleteSnapshot(input *ec2.DeleteSnapshotInput) (*ec2.DeleteSnapshotOutput, error) {
+// DeleteSnapshot deletes a snapshot after verifying the caller owns it.
+func (s *SnapshotServiceImpl) DeleteSnapshot(input *ec2.DeleteSnapshotInput, accountID string) (*ec2.DeleteSnapshotOutput, error) {
 	if input == nil || input.SnapshotId == nil {
 		return nil, errors.New(awserrors.ErrorInvalidParameterValue)
 	}
 
 	snapshotID := *input.SnapshotId
 
-	slog.Info("DeleteSnapshot request", "snapshotId", snapshotID)
+	slog.Info("DeleteSnapshot request", "snapshotId", snapshotID, "accountID", accountID)
 
 	cfg, err := s.getSnapshotConfig(snapshotID)
 	if err != nil {
@@ -412,6 +423,12 @@ func (s *SnapshotServiceImpl) DeleteSnapshot(input *ec2.DeleteSnapshotInput) (*e
 		return nil, err
 	}
 
+	// Verify ownership: caller must own the snapshot
+	if accountID != "" && cfg.OwnerID != "" && cfg.OwnerID != accountID {
+		slog.Warn("DeleteSnapshot: account does not own snapshot", "snapshotId", snapshotID, "accountID", accountID, "ownerID", cfg.OwnerID)
+		return nil, errors.New(awserrors.ErrorUnauthorizedOperation)
+	}
+
 	// Check if any volumes were created from this snapshot
 	inUse, err := s.snapshotInUseByVolumes(snapshotID)
 	if err != nil {
@@ -456,15 +473,16 @@ func (s *SnapshotServiceImpl) DeleteSnapshot(input *ec2.DeleteSnapshotInput) (*e
 	return &ec2.DeleteSnapshotOutput{}, nil
 }
 
-// CopySnapshot copies a snapshot (within same region for now)
-func (s *SnapshotServiceImpl) CopySnapshot(input *ec2.CopySnapshotInput) (*ec2.CopySnapshotOutput, error) {
+// CopySnapshot copies a snapshot (within same region for now).
+// The copied snapshot is owned by the caller's account.
+func (s *SnapshotServiceImpl) CopySnapshot(input *ec2.CopySnapshotInput, accountID string) (*ec2.CopySnapshotOutput, error) {
 	if input == nil || input.SourceSnapshotId == nil {
 		return nil, errors.New(awserrors.ErrorInvalidParameterValue)
 	}
 
 	sourceSnapshotID := *input.SourceSnapshotId
 
-	slog.Info("CopySnapshot request", "sourceSnapshotId", sourceSnapshotID)
+	slog.Info("CopySnapshot request", "sourceSnapshotId", sourceSnapshotID, "accountID", accountID)
 
 	sourceCfg, err := s.getSnapshotConfig(sourceSnapshotID)
 	if err != nil {
@@ -472,6 +490,12 @@ func (s *SnapshotServiceImpl) CopySnapshot(input *ec2.CopySnapshotInput) (*ec2.C
 		return nil, err
 	}
 
+	// Verify the caller owns the source snapshot
+	if accountID != "" && sourceCfg.OwnerID != "" && sourceCfg.OwnerID != accountID {
+		slog.Warn("CopySnapshot: account does not own source snapshot", "snapshotId", sourceSnapshotID, "accountID", accountID, "ownerID", sourceCfg.OwnerID)
+		return nil, errors.New(awserrors.ErrorUnauthorizedOperation)
+	}
+
 	newSnapshotID := utils.GenerateResourceID("snap")
 
 	newCfg := &SnapshotConfig{
@@ -483,7 +507,7 @@ func (s *SnapshotServiceImpl) CopySnapshot(input *ec2.CopySnapshotInput) (*ec2.C
 		StartTime:        time.Now(),
 		Description:      sourceCfg.Description,
 		Encrypted:        sourceCfg.Encrypted,
-		OwnerID:          sourceCfg.OwnerID,
+		OwnerID:          accountID,
 		AvailabilityZone: sourceCfg.AvailabilityZone,
 		Tags:             make(map[string]string),
 	}
diff --git a/hive/handlers/ec2/snapshot/service_impl_test.go b/hive/handlers/ec2/snapshot/service_impl_test.go
index 78b25c0bd..43ca059ea 100644
--- a/hive/handlers/ec2/snapshot/service_impl_test.go
+++ b/hive/handlers/ec2/snapshot/service_impl_test.go
@@ -19,6 +19,9 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+const testAccountID = "111122223333"
+const otherAccountID = "444455556666"
+
 // setupTestSnapshotService creates a snapshot service with in-memory storage for testing
 func setupTestSnapshotService(t *testing.T) (*SnapshotServiceImpl, *objectstore.MemoryObjectStore) {
 	store := objectstore.NewMemoryObjectStore()
@@ -77,7 +80,7 @@ func TestCreateSnapshot(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 
 	require.NoError(t, err)
 	require.NotNil(t, result)
@@ -87,6 +90,7 @@ func TestCreateSnapshot(t *testing.T) {
 	assert.Equal(t, "completed", *result.State)
 	assert.Equal(t, "100%", *result.Progress)
 	assert.Equal(t, "Test snapshot", *result.Description)
+	assert.Equal(t, testAccountID, *result.OwnerId)
 
 	// Verify tags
 	assert.Len(t, result.Tags, 1)
@@ -98,7 +102,7 @@ func TestCreateSnapshot(t *testing.T) {
 func TestCreateSnapshot_MissingVolumeId(t *testing.T) {
 	svc, _ := setupTestSnapshotService(t)
 
-	_, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{})
+	_, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidParameterValue)
 }
@@ -127,7 +131,7 @@ func TestCreateSnapshot_VolumeZeroSize(t *testing.T) {
 
 	_, err = svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId: aws.String("vol-zerosize"),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorServerInternal)
 }
@@ -138,7 +142,7 @@ func TestCreateSnapshot_VolumeNotFound(t *testing.T) {
 
 	_, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId: aws.String("vol-nonexistent"),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidVolumeNotFound)
 }
@@ -155,17 +159,17 @@ func TestDescribeSnapshots(t *testing.T) {
 	snap1, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId:    aws.String("vol-1"),
 		Description: aws.String("Snapshot 1"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	snap2, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId:    aws.String("vol-2"),
 		Description: aws.String("Snapshot 2"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Describe all snapshots
-	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{})
+	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, result)
 	assert.Len(t, result.Snapshots, 2)
@@ -189,18 +193,18 @@ func TestDescribeSnapshots_ByID(t *testing.T) {
 	// Create multiple snapshots
 	snap1, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId: aws.String("vol-1"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId: aws.String("vol-1"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Describe only the first snapshot
 	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{
 		SnapshotIds: []*string{snap1.SnapshotId},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, result)
 	assert.Len(t, result.Snapshots, 1)
@@ -211,12 +215,43 @@ func TestDescribeSnapshots_ByID(t *testing.T) {
 func TestDescribeSnapshots_Empty(t *testing.T) {
 	svc, _ := setupTestSnapshotService(t)
 
-	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{})
+	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, result)
 	assert.Empty(t, result.Snapshots)
 }
 
+// TestDescribeSnapshots_AccountScoping tests that account A cannot see account B's snapshots
+func TestDescribeSnapshots_AccountScoping(t *testing.T) {
+	svc, store := setupTestSnapshotService(t)
+
+	createTestVolume(t, store, "vol-1", 50)
+
+	// Account A creates a snapshot
+	snapA, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
+		VolumeId: aws.String("vol-1"),
+	}, testAccountID)
+	require.NoError(t, err)
+
+	// Account B creates a snapshot
+	snapB, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
+		VolumeId: aws.String("vol-1"),
+	}, otherAccountID)
+	require.NoError(t, err)
+
+	// Account A should only see its own snapshot
+	resultA, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{}, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, resultA.Snapshots, 1)
+	assert.Equal(t, *snapA.SnapshotId, *resultA.Snapshots[0].SnapshotId)
+
+	// Account B should only see its own snapshot
+	resultB, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{}, otherAccountID)
+	require.NoError(t, err)
+	require.Len(t, resultB.Snapshots, 1)
+	assert.Equal(t, *snapB.SnapshotId, *resultB.Snapshots[0].SnapshotId)
+}
+
 // TestDeleteSnapshot tests deleting a snapshot
 func TestDeleteSnapshot(t *testing.T) {
 	svc, store := setupTestSnapshotService(t)
@@ -225,30 +260,55 @@ func TestDeleteSnapshot(t *testing.T) {
 	createTestVolume(t, store, "vol-1", 50)
 	snap, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId: aws.String("vol-1"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify snapshot exists
 	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{
 		SnapshotIds: []*string{snap.SnapshotId},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Snapshots, 1)
 
 	// Delete snapshot
 	_, err = svc.DeleteSnapshot(&ec2.DeleteSnapshotInput{
 		SnapshotId: snap.SnapshotId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify snapshot is gone
 	result, err = svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{
 		SnapshotIds: []*string{snap.SnapshotId},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, result.Snapshots)
 }
 
+// TestDeleteSnapshot_WrongAccount tests that account B cannot delete account A's snapshot
+func TestDeleteSnapshot_WrongAccount(t *testing.T) {
+	svc, store := setupTestSnapshotService(t)
+
+	createTestVolume(t, store, "vol-1", 50)
+	snap, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
+		VolumeId: aws.String("vol-1"),
+	}, testAccountID)
+	require.NoError(t, err)
+
+	// Account B tries to delete account A's snapshot — should fail
+	_, err = svc.DeleteSnapshot(&ec2.DeleteSnapshotInput{
+		SnapshotId: snap.SnapshotId,
+	}, otherAccountID)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), awserrors.ErrorUnauthorizedOperation)
+
+	// Verify snapshot still exists
+	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{
+		SnapshotIds: []*string{snap.SnapshotId},
+	}, testAccountID)
+	require.NoError(t, err)
+	assert.Len(t, result.Snapshots, 1)
+}
+
 // TestDeleteSnapshot_InUseByVolume tests that deleting a snapshot fails when a volume was created from it
 func TestDeleteSnapshot_InUseByVolume(t *testing.T) {
 	svc, store := setupTestSnapshotService(t)
@@ -257,7 +317,7 @@ func TestDeleteSnapshot_InUseByVolume(t *testing.T) {
 	createTestVolume(t, store, "vol-source", 50)
 	snap, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId: aws.String("vol-source"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Create a volume that references this snapshot (simulates CreateVolume from snapshot)
@@ -281,14 +341,14 @@ func TestDeleteSnapshot_InUseByVolume(t *testing.T) {
 	// Attempt to delete the snapshot — should fail
 	_, err = svc.DeleteSnapshot(&ec2.DeleteSnapshotInput{
 		SnapshotId: snap.SnapshotId,
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidSnapshotInUse)
 
 	// Verify snapshot still exists
 	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{
 		SnapshotIds: []*string{snap.SnapshotId},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Snapshots, 1)
 }
@@ -299,7 +359,7 @@ func TestDeleteSnapshot_NotFound(t *testing.T) {
 
 	_, err := svc.DeleteSnapshot(&ec2.DeleteSnapshotInput{
 		SnapshotId: aws.String("snap-nonexistent"),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidSnapshotNotFound)
 }
@@ -308,7 +368,7 @@ func TestDeleteSnapshot_NotFound(t *testing.T) {
 func TestDeleteSnapshot_MissingID(t *testing.T) {
 	svc, _ := setupTestSnapshotService(t)
 
-	_, err := svc.DeleteSnapshot(&ec2.DeleteSnapshotInput{})
+	_, err := svc.DeleteSnapshot(&ec2.DeleteSnapshotInput{}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidParameterValue)
 }
@@ -322,32 +382,80 @@ func TestCopySnapshot(t *testing.T) {
 	snap, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId:    aws.String("vol-1"),
 		Description: aws.String("Original snapshot"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Copy snapshot
 	copyResult, err := svc.CopySnapshot(&ec2.CopySnapshotInput{
 		SourceSnapshotId: snap.SnapshotId,
 		Description:      aws.String("Copied snapshot"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, copyResult)
 	assert.True(t, strings.HasPrefix(*copyResult.SnapshotId, "snap-"))
 	assert.NotEqual(t, *snap.SnapshotId, *copyResult.SnapshotId)
 
 	// Verify both snapshots exist
-	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{})
+	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Snapshots, 2)
 }
 
+// TestCopySnapshot_SetsCallerAsOwner tests that copied snapshot is owned by the caller
+func TestCopySnapshot_SetsCallerAsOwner(t *testing.T) {
+	svc, store := setupTestSnapshotService(t)
+
+	createTestVolume(t, store, "vol-1", 50)
+	snap, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
+		VolumeId: aws.String("vol-1"),
+	}, testAccountID)
+	require.NoError(t, err)
+
+	// Copy snapshot as the same account
+	copyResult, err := svc.CopySnapshot(&ec2.CopySnapshotInput{
+		SourceSnapshotId: snap.SnapshotId,
+	}, testAccountID)
+	require.NoError(t, err)
+
+	// Verify copied snapshot owner is the caller
+	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{
+		SnapshotIds: []*string{copyResult.SnapshotId},
+	}, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, result.Snapshots, 1)
+	assert.Equal(t, testAccountID, *result.Snapshots[0].OwnerId)
+}
+
+// TestCopySnapshot_WrongAccount tests that account B cannot copy account A's snapshot
+func TestCopySnapshot_WrongAccount(t *testing.T) {
+	svc, store := setupTestSnapshotService(t)
+
+	createTestVolume(t, store, "vol-1", 50)
+	_, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
+		VolumeId: aws.String("vol-1"),
+	}, testAccountID)
+	require.NoError(t, err)
+
+	// Get the snapshot ID
+	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{}, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, result.Snapshots, 1)
+
+	// Account B tries to copy account A's snapshot — should fail
+	_, err = svc.CopySnapshot(&ec2.CopySnapshotInput{
+		SourceSnapshotId: result.Snapshots[0].SnapshotId,
+	}, otherAccountID)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), awserrors.ErrorUnauthorizedOperation)
+}
+
 // TestCopySnapshot_NotFound tests copying a non-existent snapshot
 func TestCopySnapshot_NotFound(t *testing.T) {
 	svc, _ := setupTestSnapshotService(t)
 
 	_, err := svc.CopySnapshot(&ec2.CopySnapshotInput{
 		SourceSnapshotId: aws.String("snap-nonexistent"),
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidSnapshotNotFound)
 }
@@ -356,7 +464,7 @@ func TestCopySnapshot_NotFound(t *testing.T) {
 func TestCopySnapshot_MissingSourceID(t *testing.T) {
 	svc, _ := setupTestSnapshotService(t)
 
-	_, err := svc.CopySnapshot(&ec2.CopySnapshotInput{})
+	_, err := svc.CopySnapshot(&ec2.CopySnapshotInput{}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidParameterValue)
 }
@@ -377,19 +485,19 @@ func TestCopySnapshot_PreservesTags(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Copy snapshot
 	copyResult, err := svc.CopySnapshot(&ec2.CopySnapshotInput{
 		SourceSnapshotId: snap.SnapshotId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify copied snapshot has tags
 	result, err := svc.DescribeSnapshots(&ec2.DescribeSnapshotsInput{
 		SnapshotIds: []*string{copyResult.SnapshotId},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, result.Snapshots, 1)
 	assert.Len(t, result.Snapshots[0].Tags, 1)
@@ -522,7 +630,7 @@ func TestCreateSnapshot_WritesKVEntry(t *testing.T) {
 
 	snap, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId: aws.String(volumeID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify KV entry exists
@@ -554,13 +662,13 @@ func TestDeleteSnapshot_RemovesKVEntry(t *testing.T) {
 
 	snap, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId: aws.String(volumeID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Delete the snapshot
 	_, err = svc.DeleteSnapshot(&ec2.DeleteSnapshotInput{
 		SnapshotId: snap.SnapshotId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// KV should now be empty for this volume
@@ -585,12 +693,12 @@ func TestCopySnapshot_AddsKVEntry(t *testing.T) {
 
 	snap, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
 		VolumeId: aws.String(volumeID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	copyResult, err := svc.CopySnapshot(&ec2.CopySnapshotInput{
 		SourceSnapshotId: snap.SnapshotId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Both snapshot IDs should be in KV
@@ -602,3 +710,58 @@ func TestCopySnapshot_AddsKVEntry(t *testing.T) {
 	assert.Contains(t, snapshots, *copyResult.SnapshotId)
 	assert.Len(t, snapshots, 2)
 }
+
+// TestCreateSnapshot_CrossAccountVolumeRejected tests that snapshotting another account's volume is rejected.
+func TestCreateSnapshot_CrossAccountVolumeRejected(t *testing.T) {
+	svc, store := setupTestSnapshotService(t)
+
+	// Create a volume owned by testAccountID (via TenantID)
+	volumeID := "vol-owned-by-alpha"
+	volumeState := viperblock.VBState{
+		VolumeConfig: viperblock.VolumeConfig{
+			VolumeMetadata: viperblock.VolumeMetadata{
+				SizeGiB:          100,
+				TenantID:         testAccountID,
+				AvailabilityZone: "us-east-1a",
+			},
+		},
+	}
+	data, err := json.Marshal(volumeState)
+	require.NoError(t, err)
+	_, err = store.PutObject(&s3.PutObjectInput{
+		Bucket: aws.String("test-bucket"),
+		Key:    aws.String(volumeID + "/config.json"),
+		Body:   strings.NewReader(string(data)),
+	})
+	require.NoError(t, err)
+
+	// Another account tries to snapshot the volume — should fail
+	_, err = svc.CreateSnapshot(&ec2.CreateSnapshotInput{
+		VolumeId: aws.String(volumeID),
+	}, otherAccountID)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), awserrors.ErrorInvalidVolumeNotFound)
+
+	// Same account can snapshot — should succeed
+	result, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
+		VolumeId: aws.String(volumeID),
+	}, testAccountID)
+	require.NoError(t, err)
+	assert.Equal(t, testAccountID, *result.OwnerId)
+}
+
+// TestCreateSnapshot_PrePhase4VolumeAllowed tests that volumes without TenantID (pre-phase4) are allowed.
+func TestCreateSnapshot_PrePhase4VolumeAllowed(t *testing.T) {
+	svc, store := setupTestSnapshotService(t)
+
+	// Create a volume with no TenantID (pre-phase4)
+	volumeID := "vol-legacy"
+	createTestVolume(t, store, volumeID, 50)
+
+	// Any account can snapshot — backward compatibility
+	result, err := svc.CreateSnapshot(&ec2.CreateSnapshotInput{
+		VolumeId: aws.String(volumeID),
+	}, otherAccountID)
+	require.NoError(t, err)
+	assert.Equal(t, otherAccountID, *result.OwnerId)
+}
diff --git a/hive/handlers/ec2/snapshot/service_nats.go b/hive/handlers/ec2/snapshot/service_nats.go
index 7e41bb243..ce4fa5916 100644
--- a/hive/handlers/ec2/snapshot/service_nats.go
+++ b/hive/handlers/ec2/snapshot/service_nats.go
@@ -18,18 +18,18 @@ func NewNATSSnapshotService(conn *nats.Conn) SnapshotService {
 	return &NATSSnapshotService{natsConn: conn}
 }
 
-func (s *NATSSnapshotService) CreateSnapshot(input *ec2.CreateSnapshotInput) (*ec2.Snapshot, error) {
-	return utils.NATSRequest[ec2.Snapshot](s.natsConn, "ec2.CreateSnapshot", input, 120*time.Second)
+func (s *NATSSnapshotService) CreateSnapshot(input *ec2.CreateSnapshotInput, accountID string) (*ec2.Snapshot, error) {
+	return utils.NATSRequest[ec2.Snapshot](s.natsConn, "ec2.CreateSnapshot", input, 120*time.Second, accountID)
 }
 
-func (s *NATSSnapshotService) DescribeSnapshots(input *ec2.DescribeSnapshotsInput) (*ec2.DescribeSnapshotsOutput, error) {
-	return utils.NATSRequest[ec2.DescribeSnapshotsOutput](s.natsConn, "ec2.DescribeSnapshots", input, 30*time.Second)
+func (s *NATSSnapshotService) DescribeSnapshots(input *ec2.DescribeSnapshotsInput, accountID string) (*ec2.DescribeSnapshotsOutput, error) {
+	return utils.NATSRequest[ec2.DescribeSnapshotsOutput](s.natsConn, "ec2.DescribeSnapshots", input, 30*time.Second, accountID)
 }
 
-func (s *NATSSnapshotService) DeleteSnapshot(input *ec2.DeleteSnapshotInput) (*ec2.DeleteSnapshotOutput, error) {
-	return utils.NATSRequest[ec2.DeleteSnapshotOutput](s.natsConn, "ec2.DeleteSnapshot", input, 60*time.Second)
+func (s *NATSSnapshotService) DeleteSnapshot(input *ec2.DeleteSnapshotInput, accountID string) (*ec2.DeleteSnapshotOutput, error) {
+	return utils.NATSRequest[ec2.DeleteSnapshotOutput](s.natsConn, "ec2.DeleteSnapshot", input, 60*time.Second, accountID)
 }
 
-func (s *NATSSnapshotService) CopySnapshot(input *ec2.CopySnapshotInput) (*ec2.CopySnapshotOutput, error) {
-	return utils.NATSRequest[ec2.CopySnapshotOutput](s.natsConn, "ec2.CopySnapshot", input, 120*time.Second)
+func (s *NATSSnapshotService) CopySnapshot(input *ec2.CopySnapshotInput, accountID string) (*ec2.CopySnapshotOutput, error) {
+	return utils.NATSRequest[ec2.CopySnapshotOutput](s.natsConn, "ec2.CopySnapshot", input, 120*time.Second, accountID)
 }
diff --git a/hive/handlers/ec2/tags/service.go b/hive/handlers/ec2/tags/service.go
index 83c9acbcc..ef02ec32f 100644
--- a/hive/handlers/ec2/tags/service.go
+++ b/hive/handlers/ec2/tags/service.go
@@ -4,7 +4,7 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // TagsService defines the interface for EC2 tag operations
 type TagsService interface {
-	CreateTags(input *ec2.CreateTagsInput) (*ec2.CreateTagsOutput, error)
-	DescribeTags(input *ec2.DescribeTagsInput) (*ec2.DescribeTagsOutput, error)
-	DeleteTags(input *ec2.DeleteTagsInput) (*ec2.DeleteTagsOutput, error)
+	CreateTags(input *ec2.CreateTagsInput, accountID string) (*ec2.CreateTagsOutput, error)
+	DescribeTags(input *ec2.DescribeTagsInput, accountID string) (*ec2.DescribeTagsOutput, error)
+	DeleteTags(input *ec2.DeleteTagsInput, accountID string) (*ec2.DeleteTagsOutput, error)
 }
diff --git a/hive/handlers/ec2/tags/service_impl.go b/hive/handlers/ec2/tags/service_impl.go
index 5344efc20..a5510af5b 100644
--- a/hive/handlers/ec2/tags/service_impl.go
+++ b/hive/handlers/ec2/tags/service_impl.go
@@ -19,7 +19,9 @@ import (
 // Ensure TagsServiceImpl implements TagsService
 var _ TagsService = (*TagsServiceImpl)(nil)
 
-// TagsServiceImpl implements TagsService with S3-backed storage
+// TagsServiceImpl implements TagsService with S3-backed storage.
+// Tags are stored per-account in S3 (tags/{accountID}/{resourceID}.json),
+// so account scoping is enforced at the storage layer.
 type TagsServiceImpl struct {
 	config *config.Config
 	store  objectstore.ObjectStore
@@ -84,9 +86,14 @@ func getResourceType(resourceID string) string {
 	return "unknown"
 }
 
-// getTagsKey returns the S3 key for storing tags for a resource
-func getTagsKey(resourceID string) string {
-	return "tags/" + resourceID + ".json"
+// getTagsKey returns the S3 key for storing tags for a resource, scoped by account
+func getTagsKey(accountID, resourceID string) string {
+	return "tags/" + accountID + "/" + resourceID + ".json"
+}
+
+// getTagsPrefix returns the S3 prefix for listing all tags for an account
+func getTagsPrefix(accountID string) string {
+	return "tags/" + accountID + "/"
 }
 
 // collectFilterValues adds non-nil string pointer values to the target map
@@ -99,8 +106,8 @@ func collectFilterValues(values []*string, target map[string]bool) {
 }
 
 // getResourceTags retrieves tags for a specific resource from S3
-func (s *TagsServiceImpl) getResourceTags(resourceID string) (map[string]string, error) {
-	key := getTagsKey(resourceID)
+func (s *TagsServiceImpl) getResourceTags(accountID, resourceID string) (map[string]string, error) {
+	key := getTagsKey(accountID, resourceID)
 
 	result, err := s.store.GetObject(&s3.GetObjectInput{
 		Bucket: aws.String(s.config.Predastore.Bucket),
@@ -123,8 +130,8 @@ func (s *TagsServiceImpl) getResourceTags(resourceID string) (map[string]string,
 }
 
 // putResourceTags stores tags for a specific resource in S3
-func (s *TagsServiceImpl) putResourceTags(resourceID string, tags map[string]string) error {
-	key := getTagsKey(resourceID)
+func (s *TagsServiceImpl) putResourceTags(accountID, resourceID string, tags map[string]string) error {
+	key := getTagsKey(accountID, resourceID)
 
 	data, err := json.Marshal(tags)
 	if err != nil {
@@ -142,7 +149,7 @@ func (s *TagsServiceImpl) putResourceTags(resourceID string, tags map[string]str
 }
 
 // CreateTags adds or overwrites tags for the specified resources
-func (s *TagsServiceImpl) CreateTags(input *ec2.CreateTagsInput) (*ec2.CreateTagsOutput, error) {
+func (s *TagsServiceImpl) CreateTags(input *ec2.CreateTagsInput, accountID string) (*ec2.CreateTagsOutput, error) {
 	if input == nil {
 		return nil, errors.New(awserrors.ErrorInvalidParameterValue)
 	}
@@ -166,7 +173,7 @@ func (s *TagsServiceImpl) CreateTags(input *ec2.CreateTagsInput) (*ec2.CreateTag
 		}
 
 		// Get existing tags
-		existingTags, err := s.getResourceTags(*resourceID)
+		existingTags, err := s.getResourceTags(accountID, *resourceID)
 		if err != nil {
 			slog.Error("CreateTags failed to get existing tags", "resourceId", *resourceID, "err", err)
 			return nil, errors.New(awserrors.ErrorServerInternal)
@@ -180,7 +187,7 @@ func (s *TagsServiceImpl) CreateTags(input *ec2.CreateTagsInput) (*ec2.CreateTag
 		}
 
 		// Save tags
-		if err := s.putResourceTags(*resourceID, existingTags); err != nil {
+		if err := s.putResourceTags(accountID, *resourceID, existingTags); err != nil {
 			slog.Error("CreateTags failed to save tags", "resourceId", *resourceID, "err", err)
 			return nil, errors.New(awserrors.ErrorServerInternal)
 		}
@@ -192,7 +199,7 @@ func (s *TagsServiceImpl) CreateTags(input *ec2.CreateTagsInput) (*ec2.CreateTag
 }
 
 // DescribeTags returns tags matching the specified filters
-func (s *TagsServiceImpl) DescribeTags(input *ec2.DescribeTagsInput) (*ec2.DescribeTagsOutput, error) {
+func (s *TagsServiceImpl) DescribeTags(input *ec2.DescribeTagsInput, accountID string) (*ec2.DescribeTagsOutput, error) {
 	s.mutex.RLock()
 	defer s.mutex.RUnlock()
 
@@ -200,10 +207,10 @@ func (s *TagsServiceImpl) DescribeTags(input *ec2.DescribeTagsInput) (*ec2.Descr
 
 	var tags []*ec2.TagDescription
 
-	// List all tag files from S3
+	// List all tag files from S3 scoped to this account
 	listResult, err := s.store.ListObjects(&s3.ListObjectsInput{
 		Bucket: aws.String(s.config.Predastore.Bucket),
-		Prefix: aws.String("tags/"),
+		Prefix: aws.String(getTagsPrefix(accountID)),
 	})
 	if err != nil {
 		slog.Error("DescribeTags failed to list objects", "err", err)
@@ -242,8 +249,8 @@ func (s *TagsServiceImpl) DescribeTags(input *ec2.DescribeTagsInput) (*ec2.Descr
 			continue
 		}
 
-		// Extract resource ID from key (tags/i-xxx.json -> i-xxx)
-		resourceID := strings.TrimPrefix(*obj.Key, "tags/")
+		// Extract resource ID from key (tags/{accountID}/i-xxx.json -> i-xxx)
+		resourceID := strings.TrimPrefix(*obj.Key, getTagsPrefix(accountID))
 		resourceID = strings.TrimSuffix(resourceID, ".json")
 		resourceType := getResourceType(resourceID)
 
@@ -258,7 +265,7 @@ func (s *TagsServiceImpl) DescribeTags(input *ec2.DescribeTagsInput) (*ec2.Descr
 		}
 
 		// Get tags for this resource
-		resourceTags, err := s.getResourceTags(resourceID)
+		resourceTags, err := s.getResourceTags(accountID, resourceID)
 		if err != nil {
 			slog.Warn("DescribeTags failed to get tags", "resourceId", resourceID, "err", err)
 			continue
@@ -292,7 +299,7 @@ func (s *TagsServiceImpl) DescribeTags(input *ec2.DescribeTagsInput) (*ec2.Descr
 }
 
 // DeleteTags removes tags from the specified resources
-func (s *TagsServiceImpl) DeleteTags(input *ec2.DeleteTagsInput) (*ec2.DeleteTagsOutput, error) {
+func (s *TagsServiceImpl) DeleteTags(input *ec2.DeleteTagsInput, accountID string) (*ec2.DeleteTagsOutput, error) {
 	if input == nil {
 		return nil, errors.New(awserrors.ErrorInvalidParameterValue)
 	}
@@ -312,7 +319,7 @@ func (s *TagsServiceImpl) DeleteTags(input *ec2.DeleteTagsInput) (*ec2.DeleteTag
 		}
 
 		// Get existing tags
-		existingTags, err := s.getResourceTags(*resourceID)
+		existingTags, err := s.getResourceTags(accountID, *resourceID)
 		if err != nil {
 			slog.Error("DeleteTags failed to get existing tags", "resourceId", *resourceID, "err", err)
 			return nil, errors.New(awserrors.ErrorServerInternal)
@@ -341,7 +348,7 @@ func (s *TagsServiceImpl) DeleteTags(input *ec2.DeleteTagsInput) (*ec2.DeleteTag
 		}
 
 		// Save updated tags
-		if err := s.putResourceTags(*resourceID, existingTags); err != nil {
+		if err := s.putResourceTags(accountID, *resourceID, existingTags); err != nil {
 			slog.Error("DeleteTags failed to save tags", "resourceId", *resourceID, "err", err)
 			return nil, errors.New(awserrors.ErrorServerInternal)
 		}
diff --git a/hive/handlers/ec2/tags/service_impl_test.go b/hive/handlers/ec2/tags/service_impl_test.go
index 3002b12ca..32c33c198 100644
--- a/hive/handlers/ec2/tags/service_impl_test.go
+++ b/hive/handlers/ec2/tags/service_impl_test.go
@@ -13,6 +13,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+const testAccountID = "111111111111"
+
 // setupTestTagsService creates a tags service with in-memory storage for testing
 func setupTestTagsService(t *testing.T) (*TagsServiceImpl, *objectstore.MemoryObjectStore) {
 	store := objectstore.NewMemoryObjectStore()
@@ -37,7 +39,7 @@ func TestCreateTags(t *testing.T) {
 			{Key: aws.String("Name"), Value: aws.String("test-instance")},
 			{Key: aws.String("Environment"), Value: aws.String("test")},
 		},
-	})
+	}, testAccountID)
 
 	require.NoError(t, err)
 	require.NotNil(t, result)
@@ -47,7 +49,7 @@ func TestCreateTags(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("resource-id"), Values: []*string{aws.String("i-test123")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, describeResult.Tags, 2)
 }
@@ -66,13 +68,13 @@ func TestCreateTags_MultipleResources(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Project"), Value: aws.String("test-project")},
 		},
-	})
+	}, testAccountID)
 
 	require.NoError(t, err)
 	require.NotNil(t, result)
 
 	// Verify tags were created for all resources
-	describeResult, err := svc.DescribeTags(&ec2.DescribeTagsInput{})
+	describeResult, err := svc.DescribeTags(&ec2.DescribeTagsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, describeResult.Tags, 3)
 }
@@ -87,7 +89,7 @@ func TestCreateTags_UpdateExisting(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Name"), Value: aws.String("original")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Update the tag
@@ -96,7 +98,7 @@ func TestCreateTags_UpdateExisting(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Name"), Value: aws.String("updated")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify tag was updated
@@ -104,7 +106,7 @@ func TestCreateTags_UpdateExisting(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("resource-id"), Values: []*string{aws.String("i-test123")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, describeResult.Tags, 1)
 	assert.Equal(t, "updated", *describeResult.Tags[0].Value)
@@ -118,7 +120,7 @@ func TestCreateTags_MissingResources(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Name"), Value: aws.String("test")},
 		},
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorMissingParameter)
 }
@@ -129,7 +131,7 @@ func TestCreateTags_MissingTags(t *testing.T) {
 
 	_, err := svc.CreateTags(&ec2.CreateTagsInput{
 		Resources: []*string{aws.String("i-test123")},
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorMissingParameter)
 }
@@ -142,17 +144,17 @@ func TestDescribeTags(t *testing.T) {
 	_, err := svc.CreateTags(&ec2.CreateTagsInput{
 		Resources: []*string{aws.String("i-test1")},
 		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("instance1")}},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = svc.CreateTags(&ec2.CreateTagsInput{
 		Resources: []*string{aws.String("vol-test1")},
 		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("volume1")}},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Describe all tags
-	result, err := svc.DescribeTags(&ec2.DescribeTagsInput{})
+	result, err := svc.DescribeTags(&ec2.DescribeTagsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Tags, 2)
 }
@@ -165,13 +167,13 @@ func TestDescribeTags_FilterByResourceID(t *testing.T) {
 	_, err := svc.CreateTags(&ec2.CreateTagsInput{
 		Resources: []*string{aws.String("i-test1")},
 		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("instance1")}},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = svc.CreateTags(&ec2.CreateTagsInput{
 		Resources: []*string{aws.String("i-test2")},
 		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("instance2")}},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Filter by resource ID
@@ -179,7 +181,7 @@ func TestDescribeTags_FilterByResourceID(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("resource-id"), Values: []*string{aws.String("i-test1")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Tags, 1)
 	assert.Equal(t, "i-test1", *result.Tags[0].ResourceId)
@@ -193,13 +195,13 @@ func TestDescribeTags_FilterByResourceType(t *testing.T) {
 	_, err := svc.CreateTags(&ec2.CreateTagsInput{
 		Resources: []*string{aws.String("i-test1")},
 		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("instance1")}},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = svc.CreateTags(&ec2.CreateTagsInput{
 		Resources: []*string{aws.String("vol-test1")},
 		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("volume1")}},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Filter by resource type
@@ -207,7 +209,7 @@ func TestDescribeTags_FilterByResourceType(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("resource-type"), Values: []*string{aws.String("instance")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Tags, 1)
 	assert.Equal(t, "instance", *result.Tags[0].ResourceType)
@@ -224,7 +226,7 @@ func TestDescribeTags_FilterByKey(t *testing.T) {
 			{Key: aws.String("Name"), Value: aws.String("instance1")},
 			{Key: aws.String("Environment"), Value: aws.String("test")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Filter by key
@@ -232,7 +234,7 @@ func TestDescribeTags_FilterByKey(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("key"), Values: []*string{aws.String("Name")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Tags, 1)
 	assert.Equal(t, "Name", *result.Tags[0].Key)
@@ -248,7 +250,7 @@ func TestDescribeTags_FilterByValue(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Environment"), Value: aws.String("production")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = svc.CreateTags(&ec2.CreateTagsInput{
@@ -256,7 +258,7 @@ func TestDescribeTags_FilterByValue(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Environment"), Value: aws.String("test")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Filter by value
@@ -264,7 +266,7 @@ func TestDescribeTags_FilterByValue(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("value"), Values: []*string{aws.String("production")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Tags, 1)
 	assert.Equal(t, "production", *result.Tags[0].Value)
@@ -274,7 +276,7 @@ func TestDescribeTags_FilterByValue(t *testing.T) {
 func TestDescribeTags_Empty(t *testing.T) {
 	svc, _ := setupTestTagsService(t)
 
-	result, err := svc.DescribeTags(&ec2.DescribeTagsInput{})
+	result, err := svc.DescribeTags(&ec2.DescribeTagsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, result.Tags)
 }
@@ -287,7 +289,7 @@ func TestDescribeTags_InvalidFilterName(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("resouce-id"), Values: []*string{aws.String("i-test1")}},
 		},
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidParameterValue)
 }
@@ -303,7 +305,7 @@ func TestDeleteTags(t *testing.T) {
 			{Key: aws.String("Name"), Value: aws.String("test")},
 			{Key: aws.String("Environment"), Value: aws.String("test")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Delete one tag
@@ -312,7 +314,7 @@ func TestDeleteTags(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Name")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify only one tag remains
@@ -320,7 +322,7 @@ func TestDeleteTags(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("resource-id"), Values: []*string{aws.String("i-test123")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Tags, 1)
 	assert.Equal(t, "Environment", *result.Tags[0].Key)
@@ -337,13 +339,13 @@ func TestDeleteTags_AllTags(t *testing.T) {
 			{Key: aws.String("Name"), Value: aws.String("test")},
 			{Key: aws.String("Environment"), Value: aws.String("test")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Delete all tags (no tags specified)
 	_, err = svc.DeleteTags(&ec2.DeleteTagsInput{
 		Resources: []*string{aws.String("i-test123")},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify no tags remain
@@ -351,7 +353,7 @@ func TestDeleteTags_AllTags(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("resource-id"), Values: []*string{aws.String("i-test123")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, result.Tags)
 }
@@ -367,7 +369,7 @@ func TestDeleteTags_ValueConditional(t *testing.T) {
 			{Key: aws.String("Environment"), Value: aws.String("production")},
 			{Key: aws.String("Team"), Value: aws.String("backend")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Try to delete Environment=staging (wrong value) — should NOT delete
@@ -376,7 +378,7 @@ func TestDeleteTags_ValueConditional(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Environment"), Value: aws.String("staging")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify both tags still exist
@@ -384,7 +386,7 @@ func TestDeleteTags_ValueConditional(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("resource-id"), Values: []*string{aws.String("i-test123")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Tags, 2)
 
@@ -394,7 +396,7 @@ func TestDeleteTags_ValueConditional(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Environment"), Value: aws.String("production")},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify only Team remains
@@ -402,7 +404,7 @@ func TestDeleteTags_ValueConditional(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("resource-id"), Values: []*string{aws.String("i-test123")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, result.Tags, 1)
 	assert.Equal(t, "Team", *result.Tags[0].Key)
@@ -416,7 +418,7 @@ func TestDeleteTags_MissingResources(t *testing.T) {
 		Tags: []*ec2.Tag{
 			{Key: aws.String("Name")},
 		},
-	})
+	}, testAccountID)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorMissingParameter)
 }
@@ -459,3 +461,115 @@ func TestMemoryObjectStore(t *testing.T) {
 	require.Error(t, err)
 	assert.True(t, objectstore.IsNoSuchKeyError(err))
 }
+
+// TestAccountIsolation_CreateAndDescribe tests that tags from one account are not visible to another
+func TestAccountIsolation_CreateAndDescribe(t *testing.T) {
+	svc, _ := setupTestTagsService(t)
+	accountA := "111111111111"
+	accountB := "222222222222"
+
+	// Account A creates tags
+	_, err := svc.CreateTags(&ec2.CreateTagsInput{
+		Resources: []*string{aws.String("i-aaa111")},
+		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("account-a-instance")}},
+	}, accountA)
+	require.NoError(t, err)
+
+	// Account B creates tags on a different resource
+	_, err = svc.CreateTags(&ec2.CreateTagsInput{
+		Resources: []*string{aws.String("i-bbb222")},
+		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("account-b-instance")}},
+	}, accountB)
+	require.NoError(t, err)
+
+	// Account A should only see its own tags
+	resultA, err := svc.DescribeTags(&ec2.DescribeTagsInput{}, accountA)
+	require.NoError(t, err)
+	assert.Len(t, resultA.Tags, 1)
+	assert.Equal(t, "i-aaa111", *resultA.Tags[0].ResourceId)
+	assert.Equal(t, "account-a-instance", *resultA.Tags[0].Value)
+
+	// Account B should only see its own tags
+	resultB, err := svc.DescribeTags(&ec2.DescribeTagsInput{}, accountB)
+	require.NoError(t, err)
+	assert.Len(t, resultB.Tags, 1)
+	assert.Equal(t, "i-bbb222", *resultB.Tags[0].ResourceId)
+	assert.Equal(t, "account-b-instance", *resultB.Tags[0].Value)
+}
+
+// TestAccountIsolation_SameResourceID tests that two accounts can tag the same resource ID independently
+func TestAccountIsolation_SameResourceID(t *testing.T) {
+	svc, _ := setupTestTagsService(t)
+	accountA := "111111111111"
+	accountB := "222222222222"
+
+	// Both accounts tag the same resource ID
+	_, err := svc.CreateTags(&ec2.CreateTagsInput{
+		Resources: []*string{aws.String("i-shared")},
+		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("from-account-a")}},
+	}, accountA)
+	require.NoError(t, err)
+
+	_, err = svc.CreateTags(&ec2.CreateTagsInput{
+		Resources: []*string{aws.String("i-shared")},
+		Tags:      []*ec2.Tag{{Key: aws.String("Name"), Value: aws.String("from-account-b")}},
+	}, accountB)
+	require.NoError(t, err)
+
+	// Each account sees its own tag value
+	resultA, err := svc.DescribeTags(&ec2.DescribeTagsInput{
+		Filters: []*ec2.Filter{
+			{Name: aws.String("resource-id"), Values: []*string{aws.String("i-shared")}},
+		},
+	}, accountA)
+	require.NoError(t, err)
+	assert.Len(t, resultA.Tags, 1)
+	assert.Equal(t, "from-account-a", *resultA.Tags[0].Value)
+
+	resultB, err := svc.DescribeTags(&ec2.DescribeTagsInput{
+		Filters: []*ec2.Filter{
+			{Name: aws.String("resource-id"), Values: []*string{aws.String("i-shared")}},
+		},
+	}, accountB)
+	require.NoError(t, err)
+	assert.Len(t, resultB.Tags, 1)
+	assert.Equal(t, "from-account-b", *resultB.Tags[0].Value)
+}
+
+// TestAccountIsolation_DeleteDoesNotAffectOtherAccount tests that deleting tags in one account doesn't affect another
+func TestAccountIsolation_DeleteDoesNotAffectOtherAccount(t *testing.T) {
+	svc, _ := setupTestTagsService(t)
+	accountA := "111111111111"
+	accountB := "222222222222"
+
+	// Both accounts create tags on same resource ID
+	_, err := svc.CreateTags(&ec2.CreateTagsInput{
+		Resources: []*string{aws.String("i-shared")},
+		Tags:      []*ec2.Tag{{Key: aws.String("Env"), Value: aws.String("prod")}},
+	}, accountA)
+	require.NoError(t, err)
+
+	_, err = svc.CreateTags(&ec2.CreateTagsInput{
+		Resources: []*string{aws.String("i-shared")},
+		Tags:      []*ec2.Tag{{Key: aws.String("Env"), Value: aws.String("staging")}},
+	}, accountB)
+	require.NoError(t, err)
+
+	// Account A deletes its tag
+	_, err = svc.DeleteTags(&ec2.DeleteTagsInput{
+		Resources: []*string{aws.String("i-shared")},
+		Tags:      []*ec2.Tag{{Key: aws.String("Env")}},
+	}, accountA)
+	require.NoError(t, err)
+
+	// Account A should have no tags
+	resultA, err := svc.DescribeTags(&ec2.DescribeTagsInput{}, accountA)
+	require.NoError(t, err)
+	assert.Empty(t, resultA.Tags)
+
+	// Account B's tag should still exist
+	resultB, err := svc.DescribeTags(&ec2.DescribeTagsInput{}, accountB)
+	require.NoError(t, err)
+	assert.Len(t, resultB.Tags, 1)
+	assert.Equal(t, "staging", *resultB.Tags[0].Value)
+}
diff --git a/hive/handlers/ec2/tags/service_nats.go b/hive/handlers/ec2/tags/service_nats.go
index 69e14c38e..04c897c67 100644
--- a/hive/handlers/ec2/tags/service_nats.go
+++ b/hive/handlers/ec2/tags/service_nats.go
@@ -18,14 +18,14 @@ func NewNATSTagsService(conn *nats.Conn) TagsService {
 	return &NATSTagsService{natsConn: conn}
 }
 
-func (s *NATSTagsService) CreateTags(input *ec2.CreateTagsInput) (*ec2.CreateTagsOutput, error) {
-	return utils.NATSRequest[ec2.CreateTagsOutput](s.natsConn, "ec2.CreateTags", input, 30*time.Second)
+func (s *NATSTagsService) CreateTags(input *ec2.CreateTagsInput, accountID string) (*ec2.CreateTagsOutput, error) {
+	return utils.NATSRequest[ec2.CreateTagsOutput](s.natsConn, "ec2.CreateTags", input, 30*time.Second, accountID)
 }
 
-func (s *NATSTagsService) DescribeTags(input *ec2.DescribeTagsInput) (*ec2.DescribeTagsOutput, error) {
-	return utils.NATSRequest[ec2.DescribeTagsOutput](s.natsConn, "ec2.DescribeTags", input, 30*time.Second)
+func (s *NATSTagsService) DescribeTags(input *ec2.DescribeTagsInput, accountID string) (*ec2.DescribeTagsOutput, error) {
+	return utils.NATSRequest[ec2.DescribeTagsOutput](s.natsConn, "ec2.DescribeTags", input, 30*time.Second, accountID)
 }
 
-func (s *NATSTagsService) DeleteTags(input *ec2.DeleteTagsInput) (*ec2.DeleteTagsOutput, error) {
-	return utils.NATSRequest[ec2.DeleteTagsOutput](s.natsConn, "ec2.DeleteTags", input, 30*time.Second)
+func (s *NATSTagsService) DeleteTags(input *ec2.DeleteTagsInput, accountID string) (*ec2.DeleteTagsOutput, error) {
+	return utils.NATSRequest[ec2.DeleteTagsOutput](s.natsConn, "ec2.DeleteTags", input, 30*time.Second, accountID)
 }
diff --git a/hive/handlers/ec2/volume/service.go b/hive/handlers/ec2/volume/service.go
index adaef015e..ec0f669ce 100644
--- a/hive/handlers/ec2/volume/service.go
+++ b/hive/handlers/ec2/volume/service.go
@@ -4,9 +4,9 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // VolumeService defines the interface for EBS volume operations
 type VolumeService interface {
-	CreateVolume(input *ec2.CreateVolumeInput) (*ec2.Volume, error)
-	DescribeVolumes(input *ec2.DescribeVolumesInput) (*ec2.DescribeVolumesOutput, error)
-	ModifyVolume(input *ec2.ModifyVolumeInput) (*ec2.ModifyVolumeOutput, error)
-	DeleteVolume(input *ec2.DeleteVolumeInput) (*ec2.DeleteVolumeOutput, error)
-	DescribeVolumeStatus(input *ec2.DescribeVolumeStatusInput) (*ec2.DescribeVolumeStatusOutput, error)
+	CreateVolume(input *ec2.CreateVolumeInput, accountID string) (*ec2.Volume, error)
+	DescribeVolumes(input *ec2.DescribeVolumesInput, accountID string) (*ec2.DescribeVolumesOutput, error)
+	ModifyVolume(input *ec2.ModifyVolumeInput, accountID string) (*ec2.ModifyVolumeOutput, error)
+	DeleteVolume(input *ec2.DeleteVolumeInput, accountID string) (*ec2.DeleteVolumeOutput, error)
+	DescribeVolumeStatus(input *ec2.DescribeVolumeStatusInput, accountID string) (*ec2.DescribeVolumeStatusOutput, error)
 }
diff --git a/hive/handlers/ec2/volume/service_impl.go b/hive/handlers/ec2/volume/service_impl.go
index 6d358cc48..7f82d0ec4 100644
--- a/hive/handlers/ec2/volume/service_impl.go
+++ b/hive/handlers/ec2/volume/service_impl.go
@@ -76,7 +76,7 @@ func NewVolumeServiceImplWithStore(cfg *config.Config, store objectstore.ObjectS
 }
 
 // CreateVolume creates a new EBS volume via viperblock and persists its config to S3
-func (s *VolumeServiceImpl) CreateVolume(input *ec2.CreateVolumeInput) (*ec2.Volume, error) {
+func (s *VolumeServiceImpl) CreateVolume(input *ec2.CreateVolumeInput, accountID string) (*ec2.Volume, error) {
 	if input == nil {
 		return nil, errors.New(awserrors.ErrorInvalidParameterValue)
 	}
@@ -145,6 +145,7 @@ func (s *VolumeServiceImpl) CreateVolume(input *ec2.CreateVolumeInput) (*ec2.Vol
 	volumeConfig := viperblock.VolumeConfig{
 		VolumeMetadata: viperblock.VolumeMetadata{
 			VolumeID:         volumeID,
+			TenantID:         accountID,
 			SizeGiB:          sizeGiB,
 			State:            "available",
 			CreatedAt:        now,
@@ -223,7 +224,7 @@ func (s *VolumeServiceImpl) CreateVolume(input *ec2.CreateVolumeInput) (*ec2.Vol
 }
 
 // DescribeVolumes lists EBS volumes by reading config.json files from S3
-func (s *VolumeServiceImpl) DescribeVolumes(input *ec2.DescribeVolumesInput) (*ec2.DescribeVolumesOutput, error) {
+func (s *VolumeServiceImpl) DescribeVolumes(input *ec2.DescribeVolumesInput, accountID string) (*ec2.DescribeVolumesOutput, error) {
 	if input == nil {
 		input = &ec2.DescribeVolumesInput{}
 	}
@@ -241,7 +242,7 @@ func (s *VolumeServiceImpl) DescribeVolumes(input *ec2.DescribeVolumesInput) (*e
 				requested++
 			}
 		}
-		volumes = s.fetchVolumesByIDs(input.VolumeIds)
+		volumes = s.fetchVolumesByIDs(input.VolumeIds, accountID)
 		// AWS returns InvalidVolume.NotFound if any requested ID is missing
 		if len(volumes) != requested {
 			return nil, errors.New(awserrors.ErrorInvalidVolumeNotFound)
@@ -257,13 +258,19 @@ func (s *VolumeServiceImpl) DescribeVolumes(input *ec2.DescribeVolumesInput) (*e
 	}
 
 	for _, volumeID := range volumeIDs {
-		vol, err := s.getVolumeByID(volumeID)
+		result, err := s.getVolumeByID(volumeID)
 		if err != nil {
 			slog.Error("Failed to get volume", "volumeId", volumeID, "err", err)
 			continue
 		}
 
-		volumes = append(volumes, vol)
+		// Skip volumes not owned by the caller's account.
+		// Pre-Phase4 volumes (empty TenantID) are visible to all accounts.
+		if accountID != "" && result.tenantID != "" && result.tenantID != accountID {
+			continue
+		}
+
+		volumes = append(volumes, result.volume)
 	}
 
 	slog.Info("DescribeVolumes completed", "count", len(volumes))
@@ -274,7 +281,7 @@ func (s *VolumeServiceImpl) DescribeVolumes(input *ec2.DescribeVolumesInput) (*e
 }
 
 // DescribeVolumeStatus returns the status of one or more EBS volumes
-func (s *VolumeServiceImpl) DescribeVolumeStatus(input *ec2.DescribeVolumeStatusInput) (*ec2.DescribeVolumeStatusOutput, error) {
+func (s *VolumeServiceImpl) DescribeVolumeStatus(input *ec2.DescribeVolumeStatusInput, accountID string) (*ec2.DescribeVolumeStatusOutput, error) {
 	if input == nil {
 		input = &ec2.DescribeVolumeStatusInput{}
 	}
@@ -289,11 +296,15 @@ func (s *VolumeServiceImpl) DescribeVolumeStatus(input *ec2.DescribeVolumeStatus
 			if vid == nil {
 				continue
 			}
-			item, err := s.getVolumeStatusByID(*vid)
+			item, tenantID, err := s.getVolumeStatusByID(*vid)
 			if err != nil {
 				slog.Error("DescribeVolumeStatus volume not found", "volumeId", *vid, "err", err)
 				return nil, errors.New(awserrors.ErrorInvalidVolumeNotFound)
 			}
+			// Skip volumes not owned by the caller's account
+			if accountID != "" && tenantID != "" && tenantID != accountID {
+				return nil, errors.New(awserrors.ErrorInvalidVolumeNotFound)
+			}
 			statusItems = append(statusItems, item)
 		}
 		slog.Info("DescribeVolumeStatus completed", "count", len(statusItems))
@@ -307,12 +318,18 @@ func (s *VolumeServiceImpl) DescribeVolumeStatus(input *ec2.DescribeVolumeStatus
 	}
 
 	for _, volumeID := range volumeIDs {
-		item, err := s.getVolumeStatusByID(volumeID)
+		item, tenantID, err := s.getVolumeStatusByID(volumeID)
 		if err != nil {
 			slog.Error("Failed to get volume status", "volumeId", volumeID, "err", err)
 			continue
 		}
 
+		// Skip volumes not owned by the caller's account.
+		// Pre-Phase4 volumes (empty TenantID) are visible to all accounts.
+		if accountID != "" && tenantID != "" && tenantID != accountID {
+			continue
+		}
+
 		statusItems = append(statusItems, item)
 	}
 
@@ -325,15 +342,16 @@ func (s *VolumeServiceImpl) DescribeVolumeStatus(input *ec2.DescribeVolumeStatus
 
 // getVolumeStatusByID builds a VolumeStatusItem by reusing getVolumeByID
 // to validate the volume exists, then returning static health status.
-func (s *VolumeServiceImpl) getVolumeStatusByID(volumeID string) (*ec2.VolumeStatusItem, error) {
-	vol, err := s.getVolumeByID(volumeID)
+// Returns the status item, the tenant ID for account scoping, and any error.
+func (s *VolumeServiceImpl) getVolumeStatusByID(volumeID string) (*ec2.VolumeStatusItem, string, error) {
+	result, err := s.getVolumeByID(volumeID)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 
 	return &ec2.VolumeStatusItem{
-		VolumeId:         vol.VolumeId,
-		AvailabilityZone: vol.AvailabilityZone,
+		VolumeId:         result.volume.VolumeId,
+		AvailabilityZone: result.volume.AvailabilityZone,
 		VolumeStatus: &ec2.VolumeStatusInfo{
 			Status: aws.String("ok"),
 			Details: []*ec2.VolumeStatusDetails{
@@ -349,7 +367,7 @@ func (s *VolumeServiceImpl) getVolumeStatusByID(volumeID string) (*ec2.VolumeSta
 		},
 		Actions: []*ec2.VolumeStatusAction{},
 		Events:  []*ec2.VolumeStatusEvent{},
-	}, nil
+	}, result.tenantID, nil
 }
 
 // listAllVolumeIDs lists all volume IDs from S3 by scanning bucket prefixes.
@@ -389,8 +407,9 @@ func (s *VolumeServiceImpl) listAllVolumeIDs() ([]string, error) {
 	return volumeIDs, nil
 }
 
-// fetchVolumesByIDs fetches multiple volumes in parallel by their IDs
-func (s *VolumeServiceImpl) fetchVolumesByIDs(volumeIDs []*string) []*ec2.Volume {
+// fetchVolumesByIDs fetches multiple volumes in parallel by their IDs,
+// filtering by accountID for account scoping.
+func (s *VolumeServiceImpl) fetchVolumesByIDs(volumeIDs []*string, accountID string) []*ec2.Volume {
 	var (
 		volumes []*ec2.Volume
 		mu      sync.Mutex
@@ -406,14 +425,20 @@ func (s *VolumeServiceImpl) fetchVolumesByIDs(volumeIDs []*string) []*ec2.Volume
 		go func(volID string) {
 			defer wg.Done()
 
-			vol, err := s.getVolumeByID(volID)
+			result, err := s.getVolumeByID(volID)
 			if err != nil {
 				slog.Debug("Volume not found", "volumeId", volID, "err", err)
 				return
 			}
 
+			// Skip volumes not owned by the caller's account.
+			// Pre-Phase4 volumes (empty TenantID) are visible to all accounts.
+			if accountID != "" && result.tenantID != "" && result.tenantID != accountID {
+				return
+			}
+
 			mu.Lock()
-			volumes = append(volumes, vol)
+			volumes = append(volumes, result.volume)
 			mu.Unlock()
 		}(*volumeID)
 	}
@@ -422,8 +447,16 @@ func (s *VolumeServiceImpl) fetchVolumesByIDs(volumeIDs []*string) []*ec2.Volume
 	return volumes
 }
 
-// getVolumeByID fetches a single volume's config from S3 and builds an EC2 Volume
-func (s *VolumeServiceImpl) getVolumeByID(volumeID string) (*ec2.Volume, error) {
+// volumeResult bundles an ec2.Volume with the owning account's TenantID
+// so callers can filter by account without a second config read.
+type volumeResult struct {
+	volume   *ec2.Volume
+	tenantID string
+}
+
+// getVolumeByID fetches a single volume's config from S3 and builds an EC2 Volume.
+// Returns the volume and the stored TenantID for account scoping.
+func (s *VolumeServiceImpl) getVolumeByID(volumeID string) (*volumeResult, error) {
 	cfg, err := s.GetVolumeConfig(volumeID)
 	if err != nil {
 		return nil, err
@@ -496,7 +529,7 @@ func (s *VolumeServiceImpl) getVolumeByID(volumeID string) (*ec2.Volume, error)
 		volume.Tags = tags
 	}
 
-	return volume, nil
+	return &volumeResult{volume: volume, tenantID: volMeta.TenantID}, nil
 }
 
 // volumeConfigWrapper matches the JSON structure stored in S3 config.json files
@@ -620,7 +653,7 @@ func (s *VolumeServiceImpl) UpdateVolumeState(volumeID, state, attachedInstance,
 }
 
 // ModifyVolume modifies an EBS volume (grow-only, requires stopped instance)
-func (s *VolumeServiceImpl) ModifyVolume(input *ec2.ModifyVolumeInput) (*ec2.ModifyVolumeOutput, error) {
+func (s *VolumeServiceImpl) ModifyVolume(input *ec2.ModifyVolumeInput, accountID string) (*ec2.ModifyVolumeOutput, error) {
 	if input.VolumeId == nil || *input.VolumeId == "" {
 		return nil, errors.New(awserrors.ErrorInvalidVolumeIDMalformed)
 	}
@@ -634,6 +667,11 @@ func (s *VolumeServiceImpl) ModifyVolume(input *ec2.ModifyVolumeInput) (*ec2.Mod
 		return nil, err
 	}
 
+	// Verify caller owns this volume
+	if accountID != "" && cfg.VolumeMetadata.TenantID != "" && cfg.VolumeMetadata.TenantID != accountID {
+		return nil, errors.New(awserrors.ErrorInvalidVolumeNotFound)
+	}
+
 	volMeta := &cfg.VolumeMetadata
 
 	// Record original values before modification
@@ -703,7 +741,7 @@ func (s *VolumeServiceImpl) ModifyVolume(input *ec2.ModifyVolumeInput) (*ec2.Mod
 }
 
 // DeleteVolume deletes an EBS volume: validates state, notifies viperblockd, and removes S3 data
-func (s *VolumeServiceImpl) DeleteVolume(input *ec2.DeleteVolumeInput) (*ec2.DeleteVolumeOutput, error) {
+func (s *VolumeServiceImpl) DeleteVolume(input *ec2.DeleteVolumeInput, accountID string) (*ec2.DeleteVolumeOutput, error) {
 	if input == nil || input.VolumeId == nil || *input.VolumeId == "" {
 		return nil, errors.New(awserrors.ErrorInvalidParameterValue)
 	}
@@ -718,6 +756,11 @@ func (s *VolumeServiceImpl) DeleteVolume(input *ec2.DeleteVolumeInput) (*ec2.Del
 		return nil, err
 	}
 
+	// Verify caller owns this volume
+	if accountID != "" && cfg.VolumeMetadata.TenantID != "" && cfg.VolumeMetadata.TenantID != accountID {
+		return nil, errors.New(awserrors.ErrorInvalidVolumeNotFound)
+	}
+
 	// Validate: volume must be available and not attached
 	if cfg.VolumeMetadata.State != "available" || cfg.VolumeMetadata.AttachedInstance != "" {
 		slog.Error("DeleteVolume: volume is in use", "volumeId", volumeID, "state", cfg.VolumeMetadata.State, "attachedInstance", cfg.VolumeMetadata.AttachedInstance)
diff --git a/hive/handlers/ec2/volume/service_impl_test.go b/hive/handlers/ec2/volume/service_impl_test.go
index d2e904ad4..b758bd504 100644
--- a/hive/handlers/ec2/volume/service_impl_test.go
+++ b/hive/handlers/ec2/volume/service_impl_test.go
@@ -144,7 +144,7 @@ func TestCreateVolume_Validation(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			svc := newTestVolumeService(tt.az)
-			_, err := svc.CreateVolume(tt.input)
+			_, err := svc.CreateVolume(tt.input, "")
 			assert.Error(t, err)
 			assert.Equal(t, tt.wantErr, err.Error())
 		})
@@ -184,7 +184,7 @@ func TestCreateVolume_PassesValidation(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			svc := newTestVolumeService("ap-southeast-2a")
-			_, err := svc.CreateVolume(tt.input)
+			_, err := svc.CreateVolume(tt.input, "")
 			if err != nil {
 				assert.NotEqual(t, awserrors.ErrorInvalidParameterValue, err.Error())
 				assert.NotEqual(t, awserrors.ErrorInvalidAvailabilityZone, err.Error())
@@ -228,7 +228,7 @@ func TestDeleteVolume_Validation(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			svc := newTestVolumeService("ap-southeast-2a")
-			_, err := svc.DeleteVolume(tt.input)
+			_, err := svc.DeleteVolume(tt.input, "")
 			require.Error(t, err)
 			assert.Equal(t, tt.wantErr, err.Error())
 		})
@@ -241,7 +241,7 @@ func TestDescribeVolumeStatus_NilInputDefaults(t *testing.T) {
 	// nil input is defaulted to empty, then hits the slow path which
 	// calls listAllVolumeIDs. With an empty MemoryObjectStore, no
 	// volumes are found and an empty result is returned.
-	output, err := svc.DescribeVolumeStatus(nil)
+	output, err := svc.DescribeVolumeStatus(nil, "")
 	require.NoError(t, err)
 	assert.Empty(t, output.VolumeStatuses)
 }
@@ -254,7 +254,7 @@ func TestDescribeVolumeStatus_WithVolumeIDs(t *testing.T) {
 	// InvalidVolume.NotFound error is returned.
 	_, err := svc.DescribeVolumeStatus(&ec2.DescribeVolumeStatusInput{
 		VolumeIds: []*string{aws.String("vol-abc123")},
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidVolumeNotFound, err.Error())
 }
@@ -301,7 +301,7 @@ func TestCreateVolume_FromSnapshot_PassesValidation(t *testing.T) {
 	_, err = svc.CreateVolume(&ec2.CreateVolumeInput{
 		AvailabilityZone: aws.String("ap-southeast-2a"),
 		SnapshotId:       aws.String(snapshotID),
-	})
+	}, "")
 	if err != nil {
 		// Should not be a snapshot or validation error - those are the paths we're testing
 		assert.NotContains(t, err.Error(), awserrors.ErrorInvalidSnapshotNotFound)
@@ -334,7 +334,7 @@ func TestCreateVolume_FromSnapshot_WithExplicitSize(t *testing.T) {
 		Size:             aws.Int64(100),
 		AvailabilityZone: aws.String("ap-southeast-2a"),
 		SnapshotId:       aws.String(snapshotID),
-	})
+	}, "")
 	if err != nil {
 		assert.NotContains(t, err.Error(), awserrors.ErrorInvalidSnapshotNotFound)
 		assert.NotContains(t, err.Error(), awserrors.ErrorInvalidParameterValue)
@@ -347,7 +347,7 @@ func TestCreateVolume_FromSnapshot_NotFound(t *testing.T) {
 	_, err := svc.CreateVolume(&ec2.CreateVolumeInput{
 		AvailabilityZone: aws.String("ap-southeast-2a"),
 		SnapshotId:       aws.String("snap-nonexistent"),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidSnapshotNotFound)
 }
@@ -377,7 +377,7 @@ func TestCreateVolume_FromSnapshot_SizeSmallerThanSnapshot(t *testing.T) {
 		Size:             aws.Int64(10),
 		AvailabilityZone: aws.String("ap-southeast-2a"),
 		SnapshotId:       aws.String(snapshotID),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorInvalidParameterValue)
 }
@@ -407,7 +407,7 @@ func TestCreateVolume_FromSnapshot_SizeEqualToSnapshot(t *testing.T) {
 		Size:             aws.Int64(50),
 		AvailabilityZone: aws.String("ap-southeast-2a"),
 		SnapshotId:       aws.String(snapshotID),
-	})
+	}, "")
 	if err != nil {
 		assert.NotContains(t, err.Error(), awserrors.ErrorInvalidParameterValue)
 		assert.NotContains(t, err.Error(), awserrors.ErrorInvalidSnapshotNotFound)
@@ -431,7 +431,7 @@ func TestCreateVolume_FromSnapshot_CorruptMetadata(t *testing.T) {
 	_, err = svc.CreateVolume(&ec2.CreateVolumeInput{
 		AvailabilityZone: aws.String("ap-southeast-2a"),
 		SnapshotId:       aws.String(snapshotID),
-	})
+	}, "")
 	require.Error(t, err)
 }
 
@@ -506,7 +506,7 @@ func TestDeleteVolume_BlockedByKV(t *testing.T) {
 	// DeleteVolume should be blocked
 	_, err = svc.DeleteVolume(&ec2.DeleteVolumeInput{
 		VolumeId: aws.String(volumeID),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorVolumeInUse)
 }
@@ -523,7 +523,7 @@ func TestDeleteVolume_AllowedByKV(t *testing.T) {
 	// No KV entry → delete allowed
 	_, err := svc.DeleteVolume(&ec2.DeleteVolumeInput{
 		VolumeId: aws.String(volumeID),
-	})
+	}, "")
 	require.NoError(t, err)
 }
 
@@ -538,7 +538,7 @@ func TestDeleteVolume_ErrorWhenKVNil(t *testing.T) {
 	// Should fail because snapshotKV is nil
 	_, err := svc.DeleteVolume(&ec2.DeleteVolumeInput{
 		VolumeId: aws.String(volumeID),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), awserrors.ErrorServerInternal)
 }
@@ -611,8 +611,9 @@ func TestGetVolumeByID_FullMetadata(t *testing.T) {
 	}
 	createVolumeInStoreWithMeta(t, store, "vol-full", meta)
 
-	vol, err := svc.getVolumeByID("vol-full")
+	result, err := svc.getVolumeByID("vol-full")
 	require.NoError(t, err)
+	vol := result.volume
 
 	assert.Equal(t, "vol-full", *vol.VolumeId)
 	assert.Equal(t, int64(20), *vol.Size)
@@ -648,11 +649,11 @@ func TestGetVolumeByID_AttachmentDetached(t *testing.T) {
 	}
 	createVolumeInStoreWithMeta(t, store, "vol-detach", meta)
 
-	vol, err := svc.getVolumeByID("vol-detach")
+	result, err := svc.getVolumeByID("vol-detach")
 	require.NoError(t, err)
 
-	require.Len(t, vol.Attachments, 1)
-	assert.Equal(t, "detached", *vol.Attachments[0].State)
+	require.Len(t, result.volume.Attachments, 1)
+	assert.Equal(t, "detached", *result.volume.Attachments[0].State)
 }
 
 func TestGetVolumeByID_DefaultStateAndType(t *testing.T) {
@@ -666,11 +667,11 @@ func TestGetVolumeByID_DefaultStateAndType(t *testing.T) {
 	}
 	createVolumeInStoreWithMeta(t, store, "vol-defaults", meta)
 
-	vol, err := svc.getVolumeByID("vol-defaults")
+	result, err := svc.getVolumeByID("vol-defaults")
 	require.NoError(t, err)
 
-	assert.Equal(t, "available", *vol.State)
-	assert.Equal(t, "gp3", *vol.VolumeType)
+	assert.Equal(t, "available", *result.volume.State)
+	assert.Equal(t, "gp3", *result.volume.VolumeType)
 }
 
 func TestGetVolumeByID_EmptyVolumeID(t *testing.T) {
@@ -723,7 +724,7 @@ func TestDescribeVolumes_NilInput(t *testing.T) {
 		VolumeID: "vol-nil1", SizeGiB: 10, State: "available",
 	})
 
-	output, err := svc.DescribeVolumes(nil)
+	output, err := svc.DescribeVolumes(nil, "")
 	require.NoError(t, err)
 	assert.Len(t, output.Volumes, 1)
 }
@@ -732,7 +733,7 @@ func TestDescribeVolumes_EmptyStore(t *testing.T) {
 	store := objectstore.NewMemoryObjectStore()
 	svc := newTestVolumeServiceWithStore("ap-southeast-2a", store)
 
-	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{})
+	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{}, "")
 	require.NoError(t, err)
 	assert.Empty(t, output.Volumes)
 }
@@ -747,7 +748,7 @@ func TestDescribeVolumes_SlowPath_MultipleVolumes(t *testing.T) {
 		})
 	}
 
-	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{})
+	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{}, "")
 	require.NoError(t, err)
 	assert.Len(t, output.Volumes, 3)
 }
@@ -764,7 +765,7 @@ func TestDescribeVolumes_FastPath_SpecificIDs(t *testing.T) {
 
 	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{
 		VolumeIds: []*string{aws.String("vol-x"), aws.String("vol-z")},
-	})
+	}, "")
 	require.NoError(t, err)
 	assert.Len(t, output.Volumes, 2)
 
@@ -787,7 +788,7 @@ func TestDescribeVolumes_FastPath_MixedExistingAndMissing(t *testing.T) {
 	// AWS returns InvalidVolume.NotFound when any requested ID is missing
 	_, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{
 		VolumeIds: []*string{aws.String("vol-exists"), aws.String("vol-ghost")},
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidVolumeNotFound, err.Error())
 }
@@ -802,11 +803,174 @@ func TestDescribeVolumes_FastPath_NilVolumeID(t *testing.T) {
 
 	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{
 		VolumeIds: []*string{nil, aws.String("vol-ok")},
-	})
+	}, "")
 	require.NoError(t, err)
 	assert.Len(t, output.Volumes, 1)
 }
 
+// --- Group 2b: Account scoping tests ---
+
+func TestDescribeVolumes_AccountScoping_SlowPath(t *testing.T) {
+	store := objectstore.NewMemoryObjectStore()
+	svc := newTestVolumeServiceWithStore("ap-southeast-2a", store)
+
+	// Create volumes for two different accounts and one pre-Phase4 (empty TenantID)
+	createVolumeInStoreWithMeta(t, store, "vol-acctA", viperblock.VolumeMetadata{
+		VolumeID: "vol-acctA", SizeGiB: 10, State: "available", TenantID: "111111111111",
+	})
+	createVolumeInStoreWithMeta(t, store, "vol-acctB", viperblock.VolumeMetadata{
+		VolumeID: "vol-acctB", SizeGiB: 10, State: "available", TenantID: "222222222222",
+	})
+	createVolumeInStoreWithMeta(t, store, "vol-legacy", viperblock.VolumeMetadata{
+		VolumeID: "vol-legacy", SizeGiB: 10, State: "available", TenantID: "",
+	})
+
+	// Account A sees its own volume + legacy (empty TenantID)
+	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{}, "111111111111")
+	require.NoError(t, err)
+	ids := map[string]bool{}
+	for _, v := range output.Volumes {
+		ids[*v.VolumeId] = true
+	}
+	assert.True(t, ids["vol-acctA"], "Account A should see its own volume")
+	assert.False(t, ids["vol-acctB"], "Account A should NOT see Account B's volume")
+	assert.True(t, ids["vol-legacy"], "Account A should see pre-Phase4 volumes")
+
+	// Account B sees its own volume + legacy
+	output, err = svc.DescribeVolumes(&ec2.DescribeVolumesInput{}, "222222222222")
+	require.NoError(t, err)
+	ids = map[string]bool{}
+	for _, v := range output.Volumes {
+		ids[*v.VolumeId] = true
+	}
+	assert.True(t, ids["vol-acctB"], "Account B should see its own volume")
+	assert.False(t, ids["vol-acctA"], "Account B should NOT see Account A's volume")
+	assert.True(t, ids["vol-legacy"], "Account B should see pre-Phase4 volumes")
+
+	// Empty accountID sees all volumes (backward compat)
+	output, err = svc.DescribeVolumes(&ec2.DescribeVolumesInput{}, "")
+	require.NoError(t, err)
+	assert.Len(t, output.Volumes, 3)
+}
+
+func TestDescribeVolumes_AccountScoping_FastPath(t *testing.T) {
+	store := objectstore.NewMemoryObjectStore()
+	svc := newTestVolumeServiceWithStore("ap-southeast-2a", store)
+
+	createVolumeInStoreWithMeta(t, store, "vol-mine", viperblock.VolumeMetadata{
+		VolumeID: "vol-mine", SizeGiB: 10, State: "available", TenantID: "111111111111",
+	})
+	createVolumeInStoreWithMeta(t, store, "vol-other", viperblock.VolumeMetadata{
+		VolumeID: "vol-other", SizeGiB: 10, State: "available", TenantID: "222222222222",
+	})
+
+	// Requesting another account's volume by ID returns NotFound
+	_, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{
+		VolumeIds: []*string{aws.String("vol-other")},
+	}, "111111111111")
+	assert.Error(t, err)
+	assert.Equal(t, awserrors.ErrorInvalidVolumeNotFound, err.Error())
+
+	// Requesting own volume by ID succeeds
+	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{
+		VolumeIds: []*string{aws.String("vol-mine")},
+	}, "111111111111")
+	require.NoError(t, err)
+	assert.Len(t, output.Volumes, 1)
+	assert.Equal(t, "vol-mine", *output.Volumes[0].VolumeId)
+}
+
+func TestDeleteVolume_AccountScoping(t *testing.T) {
+	store := objectstore.NewMemoryObjectStore()
+	svc := newTestVolumeServiceWithStore("ap-southeast-2a", store)
+	svc.snapshotKV = setupTestVolumeKV(t)
+
+	createVolumeInStoreWithMeta(t, store, "vol-owned", viperblock.VolumeMetadata{
+		VolumeID: "vol-owned", SizeGiB: 10, State: "available", TenantID: "111111111111",
+	})
+
+	// Another account cannot delete
+	_, err := svc.DeleteVolume(&ec2.DeleteVolumeInput{
+		VolumeId: aws.String("vol-owned"),
+	}, "222222222222")
+	assert.Error(t, err)
+	assert.Equal(t, awserrors.ErrorInvalidVolumeNotFound, err.Error())
+
+	// Owner can delete
+	_, err = svc.DeleteVolume(&ec2.DeleteVolumeInput{
+		VolumeId: aws.String("vol-owned"),
+	}, "111111111111")
+	require.NoError(t, err)
+}
+
+func TestModifyVolume_AccountScoping(t *testing.T) {
+	store := objectstore.NewMemoryObjectStore()
+	svc := newTestVolumeServiceWithStore("ap-southeast-2a", store)
+
+	createVolumeInStoreWithMeta(t, store, "vol-modify", viperblock.VolumeMetadata{
+		VolumeID: "vol-modify", SizeGiB: 10, State: "available", TenantID: "111111111111",
+	})
+
+	// Another account cannot modify
+	_, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
+		VolumeId: aws.String("vol-modify"),
+		Size:     aws.Int64(20),
+	}, "222222222222")
+	assert.Error(t, err)
+	assert.Equal(t, awserrors.ErrorInvalidVolumeNotFound, err.Error())
+
+	// Owner can modify
+	output, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
+		VolumeId: aws.String("vol-modify"),
+		Size:     aws.Int64(20),
+	}, "111111111111")
+	require.NoError(t, err)
+	assert.Equal(t, int64(20), *output.VolumeModification.TargetSize)
+}
+
+func TestDescribeVolumeStatus_AccountScoping(t *testing.T) {
+	store := objectstore.NewMemoryObjectStore()
+	svc := newTestVolumeServiceWithStore("ap-southeast-2a", store)
+
+	createVolumeInStoreWithMeta(t, store, "vol-statusA", viperblock.VolumeMetadata{
+		VolumeID: "vol-statusA", SizeGiB: 10, State: "available", TenantID: "111111111111",
+	})
+	createVolumeInStoreWithMeta(t, store, "vol-statusB", viperblock.VolumeMetadata{
+		VolumeID: "vol-statusB", SizeGiB: 10, State: "available", TenantID: "222222222222",
+	})
+
+	// Slow path: Account A only sees its own volume status
+	output, err := svc.DescribeVolumeStatus(nil, "111111111111")
+	require.NoError(t, err)
+	assert.Len(t, output.VolumeStatuses, 1)
+	assert.Equal(t, "vol-statusA", *output.VolumeStatuses[0].VolumeId)
+
+	// Fast path: Account A cannot query Account B's volume status
+	_, err = svc.DescribeVolumeStatus(&ec2.DescribeVolumeStatusInput{
+		VolumeIds: []*string{aws.String("vol-statusB")},
+	}, "111111111111")
+	assert.Error(t, err)
+	assert.Equal(t, awserrors.ErrorInvalidVolumeNotFound, err.Error())
+}
+
+func TestCreateVolume_StampsAccountID(t *testing.T) {
+	store := objectstore.NewMemoryObjectStore()
+	svc := newTestVolumeServiceWithStore("ap-southeast-2a", store)
+
+	// CreateVolume will fail at viperblock layer (no real S3), but the
+	// VolumeConfig should have TenantID set if we can inspect it.
+	// We test via the validation path — CreateVolume with invalid size
+	// should NOT fail because of accountID.
+	_, err := svc.CreateVolume(&ec2.CreateVolumeInput{
+		Size:             aws.Int64(1),
+		AvailabilityZone: aws.String("ap-southeast-2a"),
+	}, "111111111111")
+	// Will error at viperblock layer, not at account validation
+	if err != nil {
+		assert.NotEqual(t, awserrors.ErrorInvalidParameterValue, err.Error())
+	}
+}
+
 // --- Group 3: ModifyVolume tests ---
 
 func TestModifyVolume_NilVolumeID(t *testing.T) {
@@ -814,7 +978,7 @@ func TestModifyVolume_NilVolumeID(t *testing.T) {
 
 	_, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
 		VolumeId: nil,
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidVolumeIDMalformed, err.Error())
 }
@@ -824,7 +988,7 @@ func TestModifyVolume_EmptyVolumeID(t *testing.T) {
 
 	_, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
 		VolumeId: aws.String(""),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidVolumeIDMalformed, err.Error())
 }
@@ -835,7 +999,7 @@ func TestModifyVolume_VolumeNotFound(t *testing.T) {
 	_, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
 		VolumeId: aws.String("vol-nonexistent"),
 		Size:     aws.Int64(20),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidVolumeNotFound, err.Error())
 }
@@ -851,7 +1015,7 @@ func TestModifyVolume_ShrinkRejected(t *testing.T) {
 	_, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
 		VolumeId: aws.String("vol-shrink"),
 		Size:     aws.Int64(5),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidParameterValue, err.Error())
 }
@@ -867,7 +1031,7 @@ func TestModifyVolume_SameSizeRejected(t *testing.T) {
 	_, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
 		VolumeId: aws.String("vol-same"),
 		Size:     aws.Int64(10),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidParameterValue, err.Error())
 }
@@ -886,7 +1050,7 @@ func TestModifyVolume_AttachedInUse(t *testing.T) {
 	_, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
 		VolumeId: aws.String("vol-inuse"),
 		Size:     aws.Int64(20),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorIncorrectState, err.Error())
 }
@@ -906,7 +1070,7 @@ func TestModifyVolume_SuccessfulGrow(t *testing.T) {
 	output, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
 		VolumeId: aws.String("vol-grow"),
 		Size:     aws.Int64(20),
-	})
+	}, "")
 	require.NoError(t, err)
 
 	mod := output.VolumeModification
@@ -939,7 +1103,7 @@ func TestModifyVolume_ModifyTypeAndIOPS(t *testing.T) {
 		Size:       aws.Int64(20),
 		VolumeType: aws.String("io1"),
 		Iops:       aws.Int64(10000),
-	})
+	}, "")
 	require.NoError(t, err)
 
 	mod := output.VolumeModification
@@ -964,7 +1128,7 @@ func TestModifyVolume_AvailableWithAttachment(t *testing.T) {
 	output, err := svc.ModifyVolume(&ec2.ModifyVolumeInput{
 		VolumeId: aws.String("vol-stopinst"),
 		Size:     aws.Int64(20),
-	})
+	}, "")
 	require.NoError(t, err)
 	assert.Equal(t, int64(20), *output.VolumeModification.TargetSize)
 }
@@ -1131,7 +1295,7 @@ func TestDeleteVolume_VolumeInUse(t *testing.T) {
 
 	_, err := svc.DeleteVolume(&ec2.DeleteVolumeInput{
 		VolumeId: aws.String("vol-busy"),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorVolumeInUse, err.Error())
 }
@@ -1154,7 +1318,7 @@ func TestDeleteVolume_VolumeAttachedButAvailable(t *testing.T) {
 
 	_, err := svc.DeleteVolume(&ec2.DeleteVolumeInput{
 		VolumeId: aws.String("vol-attached"),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorVolumeInUse, err.Error())
 }
@@ -1202,7 +1366,7 @@ func TestDeleteVolume_WithNATSNotification(t *testing.T) {
 
 	_, err = svc.DeleteVolume(&ec2.DeleteVolumeInput{
 		VolumeId: aws.String(volumeID),
-	})
+	}, "")
 	require.NoError(t, err)
 
 	// Verify all objects deleted
@@ -1222,7 +1386,7 @@ func TestDescribeVolumeStatus_SlowPath_WithVolumes(t *testing.T) {
 		})
 	}
 
-	output, err := svc.DescribeVolumeStatus(nil)
+	output, err := svc.DescribeVolumeStatus(nil, "")
 	require.NoError(t, err)
 	assert.Len(t, output.VolumeStatuses, 2)
 
@@ -1246,7 +1410,7 @@ func TestDescribeVolumeStatus_FastPath_WithVolumes(t *testing.T) {
 
 	output, err := svc.DescribeVolumeStatus(&ec2.DescribeVolumeStatusInput{
 		VolumeIds: []*string{aws.String("vol-status1")},
-	})
+	}, "")
 	require.NoError(t, err)
 	require.Len(t, output.VolumeStatuses, 1)
 	assert.Equal(t, "vol-status1", *output.VolumeStatuses[0].VolumeId)
@@ -1266,7 +1430,7 @@ func TestDescribeVolumes_SlowPath_SkipsBrokenConfig(t *testing.T) {
 		VolumeID: "vol-bad", SizeGiB: 0,
 	})
 
-	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{})
+	output, err := svc.DescribeVolumes(&ec2.DescribeVolumesInput{}, "")
 	require.NoError(t, err)
 	// Only the good volume should be returned
 	assert.Len(t, output.Volumes, 1)
@@ -1284,7 +1448,7 @@ func TestDescribeVolumeStatus_SlowPath_SkipsBrokenConfig(t *testing.T) {
 		VolumeID: "vol-broken", SizeGiB: 0,
 	})
 
-	output, err := svc.DescribeVolumeStatus(nil)
+	output, err := svc.DescribeVolumeStatus(nil, "")
 	require.NoError(t, err)
 	assert.Len(t, output.VolumeStatuses, 1)
 }
@@ -1341,7 +1505,7 @@ func TestDeleteVolume_NATSErrorResponse(t *testing.T) {
 
 	_, err = svc.DeleteVolume(&ec2.DeleteVolumeInput{
 		VolumeId: aws.String(volumeID),
-	})
+	}, "")
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorServerInternal, err.Error())
 }
@@ -1380,6 +1544,6 @@ func TestDeleteVolume_NATSTimeout(t *testing.T) {
 	// No subscriber → NATS request will timeout, but delete proceeds (best-effort)
 	_, err = svc.DeleteVolume(&ec2.DeleteVolumeInput{
 		VolumeId: aws.String(volumeID),
-	})
+	}, "")
 	require.NoError(t, err)
 }
diff --git a/hive/handlers/ec2/volume/service_nats.go b/hive/handlers/ec2/volume/service_nats.go
index f96e7c2aa..dc10b9d93 100644
--- a/hive/handlers/ec2/volume/service_nats.go
+++ b/hive/handlers/ec2/volume/service_nats.go
@@ -18,22 +18,22 @@ func NewNATSVolumeService(conn *nats.Conn) VolumeService {
 	return &NATSVolumeService{natsConn: conn}
 }
 
-func (s *NATSVolumeService) CreateVolume(input *ec2.CreateVolumeInput) (*ec2.Volume, error) {
-	return utils.NATSRequest[ec2.Volume](s.natsConn, "ec2.CreateVolume", input, 30*time.Second)
+func (s *NATSVolumeService) CreateVolume(input *ec2.CreateVolumeInput, accountID string) (*ec2.Volume, error) {
+	return utils.NATSRequest[ec2.Volume](s.natsConn, "ec2.CreateVolume", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVolumeService) DescribeVolumes(input *ec2.DescribeVolumesInput) (*ec2.DescribeVolumesOutput, error) {
-	return utils.NATSRequest[ec2.DescribeVolumesOutput](s.natsConn, "ec2.DescribeVolumes", input, 30*time.Second)
+func (s *NATSVolumeService) DescribeVolumes(input *ec2.DescribeVolumesInput, accountID string) (*ec2.DescribeVolumesOutput, error) {
+	return utils.NATSRequest[ec2.DescribeVolumesOutput](s.natsConn, "ec2.DescribeVolumes", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVolumeService) ModifyVolume(input *ec2.ModifyVolumeInput) (*ec2.ModifyVolumeOutput, error) {
-	return utils.NATSRequest[ec2.ModifyVolumeOutput](s.natsConn, "ec2.ModifyVolume", input, 30*time.Second)
+func (s *NATSVolumeService) ModifyVolume(input *ec2.ModifyVolumeInput, accountID string) (*ec2.ModifyVolumeOutput, error) {
+	return utils.NATSRequest[ec2.ModifyVolumeOutput](s.natsConn, "ec2.ModifyVolume", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVolumeService) DescribeVolumeStatus(input *ec2.DescribeVolumeStatusInput) (*ec2.DescribeVolumeStatusOutput, error) {
-	return utils.NATSRequest[ec2.DescribeVolumeStatusOutput](s.natsConn, "ec2.DescribeVolumeStatus", input, 30*time.Second)
+func (s *NATSVolumeService) DescribeVolumeStatus(input *ec2.DescribeVolumeStatusInput, accountID string) (*ec2.DescribeVolumeStatusOutput, error) {
+	return utils.NATSRequest[ec2.DescribeVolumeStatusOutput](s.natsConn, "ec2.DescribeVolumeStatus", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVolumeService) DeleteVolume(input *ec2.DeleteVolumeInput) (*ec2.DeleteVolumeOutput, error) {
-	return utils.NATSRequest[ec2.DeleteVolumeOutput](s.natsConn, "ec2.DeleteVolume", input, 30*time.Second)
+func (s *NATSVolumeService) DeleteVolume(input *ec2.DeleteVolumeInput, accountID string) (*ec2.DeleteVolumeOutput, error) {
+	return utils.NATSRequest[ec2.DeleteVolumeOutput](s.natsConn, "ec2.DeleteVolume", input, 30*time.Second, accountID)
 }
diff --git a/hive/handlers/ec2/vpc/eni.go b/hive/handlers/ec2/vpc/eni.go
index 1eb6cbd33..3a6bb40ef 100644
--- a/hive/handlers/ec2/vpc/eni.go
+++ b/hive/handlers/ec2/vpc/eni.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -36,7 +37,7 @@ type ENIRecord struct {
 }
 
 // CreateNetworkInterface creates a new ENI in the specified subnet
-func (s *VPCServiceImpl) CreateNetworkInterface(input *ec2.CreateNetworkInterfaceInput) (*ec2.CreateNetworkInterfaceOutput, error) {
+func (s *VPCServiceImpl) CreateNetworkInterface(input *ec2.CreateNetworkInterfaceInput, accountID string) (*ec2.CreateNetworkInterfaceOutput, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -46,8 +47,8 @@ func (s *VPCServiceImpl) CreateNetworkInterface(input *ec2.CreateNetworkInterfac
 
 	subnetId := *input.SubnetId
 
-	// Verify subnet exists and get its details
-	subnetEntry, err := s.subnetKV.Get(subnetId)
+	// Verify subnet exists and belongs to this account
+	subnetEntry, err := s.subnetKV.Get(accountKey(accountID, subnetId))
 	if err != nil {
 		return nil, errors.New(awserrors.ErrorInvalidSubnetIDNotFound)
 	}
@@ -107,22 +108,22 @@ func (s *VPCServiceImpl) CreateNetworkInterface(input *ec2.CreateNetworkInterfac
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal ENI record: %w", err)
 	}
-	if _, err := s.eniKV.Put(eniId, data); err != nil {
+	if _, err := s.eniKV.Put(accountKey(accountID, eniId), data); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("CreateNetworkInterface completed", "eniId", eniId, "subnetId", subnetId, "ip", privateIP)
+	slog.Info("CreateNetworkInterface completed", "eniId", eniId, "subnetId", subnetId, "ip", privateIP, "accountID", accountID)
 
 	// Publish vpc.create-port event for vpcd topology translation
 	s.publishENIEvent("vpc.create-port", eniId, subnetId, subnet.VpcId, privateIP, macAddr)
 
 	return &ec2.CreateNetworkInterfaceOutput{
-		NetworkInterface: s.eniRecordToEC2(&record),
+		NetworkInterface: s.eniRecordToEC2(&record, accountID),
 	}, nil
 }
 
 // DeleteNetworkInterface deletes an ENI
-func (s *VPCServiceImpl) DeleteNetworkInterface(input *ec2.DeleteNetworkInterfaceInput) (*ec2.DeleteNetworkInterfaceOutput, error) {
+func (s *VPCServiceImpl) DeleteNetworkInterface(input *ec2.DeleteNetworkInterfaceInput, accountID string) (*ec2.DeleteNetworkInterfaceOutput, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -131,9 +132,10 @@ func (s *VPCServiceImpl) DeleteNetworkInterface(input *ec2.DeleteNetworkInterfac
 	}
 
 	eniId := *input.NetworkInterfaceId
+	key := accountKey(accountID, eniId)
 
 	// Get the ENI record
-	entry, err := s.eniKV.Get(eniId)
+	entry, err := s.eniKV.Get(key)
 	if err != nil {
 		return nil, errors.New(awserrors.ErrorInvalidNetworkInterfaceIDNotFound)
 	}
@@ -153,11 +155,11 @@ func (s *VPCServiceImpl) DeleteNetworkInterface(input *ec2.DeleteNetworkInterfac
 		slog.Warn("Failed to release IP during ENI delete", "eni", eniId, "ip", record.PrivateIpAddress, "err", err)
 	}
 
-	if err := s.eniKV.Delete(eniId); err != nil {
+	if err := s.eniKV.Delete(key); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("DeleteNetworkInterface completed", "eniId", eniId)
+	slog.Info("DeleteNetworkInterface completed", "eniId", eniId, "accountID", accountID)
 
 	// Publish vpc.delete-port event for vpcd topology cleanup
 	s.publishENIEvent("vpc.delete-port", eniId, record.SubnetId, record.VpcId, record.PrivateIpAddress, record.MacAddress)
@@ -166,7 +168,7 @@ func (s *VPCServiceImpl) DeleteNetworkInterface(input *ec2.DeleteNetworkInterfac
 }
 
 // DescribeNetworkInterfaces lists ENIs with optional filters
-func (s *VPCServiceImpl) DescribeNetworkInterfaces(input *ec2.DescribeNetworkInterfacesInput) (*ec2.DescribeNetworkInterfacesOutput, error) {
+func (s *VPCServiceImpl) DescribeNetworkInterfaces(input *ec2.DescribeNetworkInterfacesInput, accountID string) (*ec2.DescribeNetworkInterfacesOutput, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -197,13 +199,14 @@ func (s *VPCServiceImpl) DescribeNetworkInterfaces(input *ec2.DescribeNetworkInt
 		}
 	}
 
+	prefix := accountID + "."
 	keys, err := s.eniKV.Keys()
 	if err != nil && !errors.Is(err, nats.ErrNoKeysFound) {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
 	for _, key := range keys {
-		if len(eniIDs) > 0 && !eniIDs[key] {
+		if !strings.HasPrefix(key, prefix) {
 			continue
 		}
 
@@ -219,6 +222,10 @@ func (s *VPCServiceImpl) DescribeNetworkInterfaces(input *ec2.DescribeNetworkInt
 			continue
 		}
 
+		if len(eniIDs) > 0 && !eniIDs[record.NetworkInterfaceId] {
+			continue
+		}
+
 		if subnetFilter != "" && record.SubnetId != subnetFilter {
 			continue
 		}
@@ -229,7 +236,7 @@ func (s *VPCServiceImpl) DescribeNetworkInterfaces(input *ec2.DescribeNetworkInt
 			continue
 		}
 
-		enis = append(enis, s.eniRecordToEC2(&record))
+		enis = append(enis, s.eniRecordToEC2(&record, accountID))
 	}
 
 	// If specific ENI IDs were requested but not found, return error
@@ -247,19 +254,21 @@ func (s *VPCServiceImpl) DescribeNetworkInterfaces(input *ec2.DescribeNetworkInt
 		}
 	}
 
-	slog.Info("DescribeNetworkInterfaces completed", "count", len(enis))
+	slog.Info("DescribeNetworkInterfaces completed", "count", len(enis), "accountID", accountID)
 
 	return &ec2.DescribeNetworkInterfacesOutput{
 		NetworkInterfaces: enis,
 	}, nil
 }
 
-// AttachENI marks an ENI as attached to an instance (internal use by RunInstances)
-func (s *VPCServiceImpl) AttachENI(eniId, instanceId string, deviceIndex int64) (string, error) {
+// AttachENI marks an ENI as attached to an instance (internal use by RunInstances).
+// accountID scopes the lookup to the correct KV key.
+func (s *VPCServiceImpl) AttachENI(accountID, eniId, instanceId string, deviceIndex int64) (string, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return "", errors.New(awserrors.ErrorServerInternal)
 	}
-	entry, err := s.eniKV.Get(eniId)
+	key := accountKey(accountID, eniId)
+	entry, err := s.eniKV.Get(key)
 	if err != nil {
 		return "", errors.New(awserrors.ErrorInvalidNetworkInterfaceIDNotFound)
 	}
@@ -283,7 +292,7 @@ func (s *VPCServiceImpl) AttachENI(eniId, instanceId string, deviceIndex int64)
 	if err != nil {
 		return "", fmt.Errorf("failed to marshal ENI record: %w", err)
 	}
-	if _, err := s.eniKV.Update(eniId, data, entry.Revision()); err != nil {
+	if _, err := s.eniKV.Update(key, data, entry.Revision()); err != nil {
 		return "", errors.New(awserrors.ErrorServerInternal)
 	}
 
@@ -291,12 +300,14 @@ func (s *VPCServiceImpl) AttachENI(eniId, instanceId string, deviceIndex int64)
 	return attachmentId, nil
 }
 
-// DetachENI marks an ENI as detached from an instance (internal use by TerminateInstances)
-func (s *VPCServiceImpl) DetachENI(eniId string) error {
+// DetachENI marks an ENI as detached from an instance (internal use by TerminateInstances).
+// accountID scopes the lookup to the correct KV key.
+func (s *VPCServiceImpl) DetachENI(accountID, eniId string) error {
 	if err := s.ensureKVReady(); err != nil {
 		return errors.New(awserrors.ErrorServerInternal)
 	}
-	entry, err := s.eniKV.Get(eniId)
+	key := accountKey(accountID, eniId)
+	entry, err := s.eniKV.Get(key)
 	if err != nil {
 		return errors.New(awserrors.ErrorInvalidNetworkInterfaceIDNotFound)
 	}
@@ -315,7 +326,7 @@ func (s *VPCServiceImpl) DetachENI(eniId string) error {
 	if err != nil {
 		return fmt.Errorf("failed to marshal ENI record: %w", err)
 	}
-	if _, err := s.eniKV.Update(eniId, data, entry.Revision()); err != nil {
+	if _, err := s.eniKV.Update(key, data, entry.Revision()); err != nil {
 		return errors.New(awserrors.ErrorServerInternal)
 	}
 
@@ -324,7 +335,7 @@ func (s *VPCServiceImpl) DetachENI(eniId string) error {
 }
 
 // eniRecordToEC2 converts an ENI record to an EC2 NetworkInterface
-func (s *VPCServiceImpl) eniRecordToEC2(record *ENIRecord) *ec2.NetworkInterface {
+func (s *VPCServiceImpl) eniRecordToEC2(record *ENIRecord, accountID string) *ec2.NetworkInterface {
 	eni := &ec2.NetworkInterface{
 		NetworkInterfaceId: aws.String(record.NetworkInterfaceId),
 		SubnetId:           aws.String(record.SubnetId),
@@ -334,7 +345,7 @@ func (s *VPCServiceImpl) eniRecordToEC2(record *ENIRecord) *ec2.NetworkInterface
 		MacAddress:         aws.String(record.MacAddress),
 		Description:        aws.String(record.Description),
 		Status:             aws.String(record.Status),
-		OwnerId:            aws.String("123456789012"),
+		OwnerId:            aws.String(accountID),
 		InterfaceType:      aws.String("interface"),
 		SourceDestCheck:    aws.Bool(true),
 		PrivateIpAddresses: []*ec2.NetworkInterfacePrivateIpAddress{
diff --git a/hive/handlers/ec2/vpc/eni_test.go b/hive/handlers/ec2/vpc/eni_test.go
index 957938124..49660dfa6 100644
--- a/hive/handlers/ec2/vpc/eni_test.go
+++ b/hive/handlers/ec2/vpc/eni_test.go
@@ -15,7 +15,7 @@ func createTestENI(t *testing.T, svc *VPCServiceImpl, subnetId string) string {
 	t.Helper()
 	out, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String(subnetId),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	return *out.NetworkInterface.NetworkInterfaceId
 }
@@ -27,7 +27,7 @@ func TestCreateNetworkInterface(t *testing.T) {
 
 	out, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String(subnetId),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out.NetworkInterface)
 
@@ -47,20 +47,20 @@ func TestCreateNetworkInterface_SequentialIPs(t *testing.T) {
 
 	out1, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String(subnetId),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, "10.0.1.4", *out1.NetworkInterface.PrivateIpAddress)
 
 	out2, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String(subnetId),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, "10.0.1.5", *out2.NetworkInterface.PrivateIpAddress)
 }
 
 func TestCreateNetworkInterface_MissingSubnet(t *testing.T) {
 	svc := setupTestVPCService(t)
-	_, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{})
+	_, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -68,7 +68,7 @@ func TestCreateNetworkInterface_InvalidSubnet(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String("subnet-nonexistent"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidSubnetID.NotFound")
 }
 
@@ -88,7 +88,7 @@ func TestCreateNetworkInterface_WithTags(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, "test eni", *out.NetworkInterface.Description)
 	require.Len(t, out.NetworkInterface.TagSet, 1)
@@ -104,13 +104,13 @@ func TestDeleteNetworkInterface(t *testing.T) {
 
 	_, err := svc.DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{
 		NetworkInterfaceId: aws.String(eniId),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify deleted
 	_, err = svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{
 		NetworkInterfaceIds: []*string{aws.String(eniId)},
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidNetworkInterfaceID.NotFound")
 }
 
@@ -118,7 +118,7 @@ func TestDeleteNetworkInterface_NotFound(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{
 		NetworkInterfaceId: aws.String("eni-nonexistent"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidNetworkInterfaceID.NotFound")
 }
 
@@ -129,13 +129,13 @@ func TestDeleteNetworkInterface_InUse(t *testing.T) {
 	eniId := createTestENI(t, svc, subnetId)
 
 	// Attach the ENI
-	_, err := svc.AttachENI(eniId, "i-test123", 0)
+	_, err := svc.AttachENI(testAccountID, eniId, "i-test123", 0)
 	require.NoError(t, err)
 
 	// Try to delete — should fail
 	_, err = svc.DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{
 		NetworkInterfaceId: aws.String(eniId),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidNetworkInterface.InUse")
 }
 
@@ -147,19 +147,19 @@ func TestDeleteNetworkInterface_ReleasesIP(t *testing.T) {
 	// Create and delete an ENI
 	out1, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String(subnetId),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	ip1 := *out1.NetworkInterface.PrivateIpAddress
 
 	_, err = svc.DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{
 		NetworkInterfaceId: out1.NetworkInterface.NetworkInterfaceId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Create another ENI — should reuse the released IP
 	out2, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String(subnetId),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, ip1, *out2.NetworkInterface.PrivateIpAddress)
 }
@@ -172,7 +172,7 @@ func TestDescribeNetworkInterfaces_All(t *testing.T) {
 	createTestENI(t, svc, subnetId)
 	createTestENI(t, svc, subnetId)
 
-	out, err := svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{})
+	out, err := svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, out.NetworkInterfaces, 2)
 }
@@ -187,7 +187,7 @@ func TestDescribeNetworkInterfaces_ByID(t *testing.T) {
 
 	out, err := svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{
 		NetworkInterfaceIds: []*string{aws.String(eniId)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, out.NetworkInterfaces, 1)
 	assert.Equal(t, eniId, *out.NetworkInterfaces[0].NetworkInterfaceId)
@@ -206,7 +206,7 @@ func TestDescribeNetworkInterfaces_FilterBySubnet(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("subnet-id"), Values: []*string{aws.String(subnetA)}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, out.NetworkInterfaces, 1)
 	assert.Equal(t, subnetA, *out.NetworkInterfaces[0].SubnetId)
@@ -216,7 +216,7 @@ func TestDescribeNetworkInterfaces_NotFound(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{
 		NetworkInterfaceIds: []*string{aws.String("eni-nonexistent")},
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidNetworkInterfaceID.NotFound")
 }
 
@@ -226,14 +226,14 @@ func TestAttachENI(t *testing.T) {
 	subnetId := createTestSubnet(t, svc, vpcId, "10.0.1.0/24")
 	eniId := createTestENI(t, svc, subnetId)
 
-	attachId, err := svc.AttachENI(eniId, "i-test123", 0)
+	attachId, err := svc.AttachENI(testAccountID, eniId, "i-test123", 0)
 	require.NoError(t, err)
 	assert.Contains(t, attachId, "eni-attach-")
 
 	// Verify status changed
 	out, err := svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{
 		NetworkInterfaceIds: []*string{aws.String(eniId)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	eni := out.NetworkInterfaces[0]
 	assert.Equal(t, "in-use", *eni.Status)
@@ -248,11 +248,11 @@ func TestAttachENI_AlreadyAttached(t *testing.T) {
 	subnetId := createTestSubnet(t, svc, vpcId, "10.0.1.0/24")
 	eniId := createTestENI(t, svc, subnetId)
 
-	_, err := svc.AttachENI(eniId, "i-test123", 0)
+	_, err := svc.AttachENI(testAccountID, eniId, "i-test123", 0)
 	require.NoError(t, err)
 
 	// Second attach should fail
-	_, err = svc.AttachENI(eniId, "i-test456", 1)
+	_, err = svc.AttachENI(testAccountID, eniId, "i-test456", 1)
 	assert.ErrorContains(t, err, "InvalidNetworkInterface.InUse")
 }
 
@@ -262,16 +262,16 @@ func TestDetachENI(t *testing.T) {
 	subnetId := createTestSubnet(t, svc, vpcId, "10.0.1.0/24")
 	eniId := createTestENI(t, svc, subnetId)
 
-	_, err := svc.AttachENI(eniId, "i-test123", 0)
+	_, err := svc.AttachENI(testAccountID, eniId, "i-test123", 0)
 	require.NoError(t, err)
 
-	err = svc.DetachENI(eniId)
+	err = svc.DetachENI(testAccountID, eniId)
 	require.NoError(t, err)
 
 	// Verify status changed back
 	out, err := svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{
 		NetworkInterfaceIds: []*string{aws.String(eniId)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, "available", *out.NetworkInterfaces[0].Status)
 	assert.Nil(t, out.NetworkInterfaces[0].Attachment)
@@ -304,7 +304,7 @@ func TestDescribeNetworkInterfaces_FilterByVpcId(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("vpc-id"), Values: []*string{aws.String(vpc1)}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, out.NetworkInterfaces, 1)
 	assert.Equal(t, vpc1, *out.NetworkInterfaces[0].VpcId)
@@ -319,14 +319,14 @@ func TestDescribeNetworkInterfaces_FilterByAttachmentInstanceId(t *testing.T) {
 	createTestENI(t, svc, subnetId) // second ENI, not attached
 
 	// Attach first ENI to an instance
-	_, err := svc.AttachENI(eni1, "i-attached", 0)
+	_, err := svc.AttachENI(testAccountID, eni1, "i-attached", 0)
 	require.NoError(t, err)
 
 	out, err := svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{
 		Filters: []*ec2.Filter{
 			{Name: aws.String("attachment.instance-id"), Values: []*string{aws.String("i-attached")}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, out.NetworkInterfaces, 1)
 	assert.Equal(t, eni1, *out.NetworkInterfaces[0].NetworkInterfaceId)
@@ -342,14 +342,14 @@ func TestCreateNetworkInterface_IPExhaustion(t *testing.T) {
 	for i := range 11 {
 		_, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 			SubnetId: aws.String(subnetId),
-		})
+		}, testAccountID)
 		require.NoError(t, err, "ENI %d should succeed", i)
 	}
 
 	// 12th allocation should fail — subnet exhausted
 	_, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String(subnetId),
-	})
+	}, testAccountID)
 	assert.Error(t, err)
 }
 
@@ -369,7 +369,7 @@ func TestCreateNetworkInterface_PublishesEvent(t *testing.T) {
 
 	out, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String(subnetId),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	eniId := *out.NetworkInterface.NetworkInterfaceId
 
@@ -397,7 +397,7 @@ func TestDeleteNetworkInterface_PublishesEvent(t *testing.T) {
 
 	_, err = svc.DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{
 		NetworkInterfaceId: aws.String(eniId),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	select {
diff --git a/hive/handlers/ec2/vpc/service.go b/hive/handlers/ec2/vpc/service.go
index 94ec85eca..96df7a7c4 100644
--- a/hive/handlers/ec2/vpc/service.go
+++ b/hive/handlers/ec2/vpc/service.go
@@ -4,13 +4,13 @@ import "github.com/aws/aws-sdk-go/service/ec2"
 
 // VPCService defines the interface for VPC, Subnet, and ENI operations
 type VPCService interface {
-	CreateVpc(input *ec2.CreateVpcInput) (*ec2.CreateVpcOutput, error)
-	DeleteVpc(input *ec2.DeleteVpcInput) (*ec2.DeleteVpcOutput, error)
-	DescribeVpcs(input *ec2.DescribeVpcsInput) (*ec2.DescribeVpcsOutput, error)
-	CreateSubnet(input *ec2.CreateSubnetInput) (*ec2.CreateSubnetOutput, error)
-	DeleteSubnet(input *ec2.DeleteSubnetInput) (*ec2.DeleteSubnetOutput, error)
-	DescribeSubnets(input *ec2.DescribeSubnetsInput) (*ec2.DescribeSubnetsOutput, error)
-	CreateNetworkInterface(input *ec2.CreateNetworkInterfaceInput) (*ec2.CreateNetworkInterfaceOutput, error)
-	DeleteNetworkInterface(input *ec2.DeleteNetworkInterfaceInput) (*ec2.DeleteNetworkInterfaceOutput, error)
-	DescribeNetworkInterfaces(input *ec2.DescribeNetworkInterfacesInput) (*ec2.DescribeNetworkInterfacesOutput, error)
+	CreateVpc(input *ec2.CreateVpcInput, accountID string) (*ec2.CreateVpcOutput, error)
+	DeleteVpc(input *ec2.DeleteVpcInput, accountID string) (*ec2.DeleteVpcOutput, error)
+	DescribeVpcs(input *ec2.DescribeVpcsInput, accountID string) (*ec2.DescribeVpcsOutput, error)
+	CreateSubnet(input *ec2.CreateSubnetInput, accountID string) (*ec2.CreateSubnetOutput, error)
+	DeleteSubnet(input *ec2.DeleteSubnetInput, accountID string) (*ec2.DeleteSubnetOutput, error)
+	DescribeSubnets(input *ec2.DescribeSubnetsInput, accountID string) (*ec2.DescribeSubnetsOutput, error)
+	CreateNetworkInterface(input *ec2.CreateNetworkInterfaceInput, accountID string) (*ec2.CreateNetworkInterfaceOutput, error)
+	DeleteNetworkInterface(input *ec2.DeleteNetworkInterfaceInput, accountID string) (*ec2.DeleteNetworkInterfaceOutput, error)
+	DescribeNetworkInterfaces(input *ec2.DescribeNetworkInterfacesInput, accountID string) (*ec2.DescribeNetworkInterfacesOutput, error)
 }
diff --git a/hive/handlers/ec2/vpc/service_impl.go b/hive/handlers/ec2/vpc/service_impl.go
index ed26ab353..a2f6fe74d 100644
--- a/hive/handlers/ec2/vpc/service_impl.go
+++ b/hive/handlers/ec2/vpc/service_impl.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
@@ -176,8 +177,13 @@ func (s *VPCServiceImpl) nextVNI() (int64, error) {
 	return current, nil
 }
 
+// accountKey returns a KV key scoped to the given account: "{accountID}.{resourceID}".
+func accountKey(accountID, resourceID string) string {
+	return accountID + "." + resourceID
+}
+
 // CreateVpc creates a new VPC
-func (s *VPCServiceImpl) CreateVpc(input *ec2.CreateVpcInput) (*ec2.CreateVpcOutput, error) {
+func (s *VPCServiceImpl) CreateVpc(input *ec2.CreateVpcInput, accountID string) (*ec2.CreateVpcOutput, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -229,22 +235,22 @@ func (s *VPCServiceImpl) CreateVpc(input *ec2.CreateVpcInput) (*ec2.CreateVpcOut
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal VPC record: %w", err)
 	}
-	if _, err := s.vpcKV.Put(vpcID, data); err != nil {
+	if _, err := s.vpcKV.Put(accountKey(accountID, vpcID), data); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("CreateVpc completed", "vpcId", vpcID, "cidrBlock", record.CidrBlock, "vni", vni)
+	slog.Info("CreateVpc completed", "vpcId", vpcID, "cidrBlock", record.CidrBlock, "vni", vni, "accountID", accountID)
 
 	// Publish vpc.create event for vpcd topology translation
 	s.publishVPCEvent("vpc.create", record.VpcId, record.CidrBlock, record.VNI)
 
 	return &ec2.CreateVpcOutput{
-		Vpc: s.vpcRecordToEC2(&record),
+		Vpc: s.vpcRecordToEC2(&record, accountID),
 	}, nil
 }
 
 // DeleteVpc deletes a VPC
-func (s *VPCServiceImpl) DeleteVpc(input *ec2.DeleteVpcInput) (*ec2.DeleteVpcOutput, error) {
+func (s *VPCServiceImpl) DeleteVpc(input *ec2.DeleteVpcInput, accountID string) (*ec2.DeleteVpcOutput, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -253,18 +259,23 @@ func (s *VPCServiceImpl) DeleteVpc(input *ec2.DeleteVpcInput) (*ec2.DeleteVpcOut
 	}
 
 	vpcID := *input.VpcId
+	key := accountKey(accountID, vpcID)
 
-	if _, err := s.vpcKV.Get(vpcID); err != nil {
+	if _, err := s.vpcKV.Get(key); err != nil {
 		return nil, errors.New(awserrors.ErrorInvalidVpcIDNotFound)
 	}
 
-	// Check for dependent subnets
+	// Check for dependent subnets owned by this account
+	prefix := accountID + "."
 	subnetKeys, err := s.subnetKV.Keys()
 	if err != nil && !errors.Is(err, nats.ErrNoKeysFound) {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
-	for _, key := range subnetKeys {
-		entry, err := s.subnetKV.Get(key)
+	for _, k := range subnetKeys {
+		if !strings.HasPrefix(k, prefix) {
+			continue
+		}
+		entry, err := s.subnetKV.Get(k)
 		if err != nil {
 			continue
 		}
@@ -277,11 +288,11 @@ func (s *VPCServiceImpl) DeleteVpc(input *ec2.DeleteVpcInput) (*ec2.DeleteVpcOut
 		}
 	}
 
-	if err := s.vpcKV.Delete(vpcID); err != nil {
+	if err := s.vpcKV.Delete(key); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("DeleteVpc completed", "vpcId", vpcID)
+	slog.Info("DeleteVpc completed", "vpcId", vpcID, "accountID", accountID)
 
 	// Publish vpc.delete event for vpcd topology cleanup
 	s.publishVPCEvent("vpc.delete", vpcID, "", 0)
@@ -290,7 +301,7 @@ func (s *VPCServiceImpl) DeleteVpc(input *ec2.DeleteVpcInput) (*ec2.DeleteVpcOut
 }
 
 // DescribeVpcs describes VPCs
-func (s *VPCServiceImpl) DescribeVpcs(input *ec2.DescribeVpcsInput) (*ec2.DescribeVpcsOutput, error) {
+func (s *VPCServiceImpl) DescribeVpcs(input *ec2.DescribeVpcsInput, accountID string) (*ec2.DescribeVpcsOutput, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -303,13 +314,14 @@ func (s *VPCServiceImpl) DescribeVpcs(input *ec2.DescribeVpcsInput) (*ec2.Descri
 		}
 	}
 
+	prefix := accountID + "."
 	keys, err := s.vpcKV.Keys()
 	if err != nil && !errors.Is(err, nats.ErrNoKeysFound) {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
 	for _, key := range keys {
-		if len(vpcIDs) > 0 && !vpcIDs[key] {
+		if !strings.HasPrefix(key, prefix) {
 			continue
 		}
 
@@ -325,7 +337,11 @@ func (s *VPCServiceImpl) DescribeVpcs(input *ec2.DescribeVpcsInput) (*ec2.Descri
 			continue
 		}
 
-		vpcs = append(vpcs, s.vpcRecordToEC2(&record))
+		if len(vpcIDs) > 0 && !vpcIDs[record.VpcId] {
+			continue
+		}
+
+		vpcs = append(vpcs, s.vpcRecordToEC2(&record, accountID))
 	}
 
 	// If specific VPC IDs were requested but not found, return error
@@ -343,7 +359,7 @@ func (s *VPCServiceImpl) DescribeVpcs(input *ec2.DescribeVpcsInput) (*ec2.Descri
 		}
 	}
 
-	slog.Info("DescribeVpcs completed", "count", len(vpcs))
+	slog.Info("DescribeVpcs completed", "count", len(vpcs), "accountID", accountID)
 
 	return &ec2.DescribeVpcsOutput{
 		Vpcs: vpcs,
@@ -351,7 +367,7 @@ func (s *VPCServiceImpl) DescribeVpcs(input *ec2.DescribeVpcsInput) (*ec2.Descri
 }
 
 // CreateSubnet creates a new subnet within a VPC
-func (s *VPCServiceImpl) CreateSubnet(input *ec2.CreateSubnetInput) (*ec2.CreateSubnetOutput, error) {
+func (s *VPCServiceImpl) CreateSubnet(input *ec2.CreateSubnetInput, accountID string) (*ec2.CreateSubnetOutput, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -364,8 +380,8 @@ func (s *VPCServiceImpl) CreateSubnet(input *ec2.CreateSubnetInput) (*ec2.Create
 
 	vpcID := *input.VpcId
 
-	// Verify VPC exists
-	vpcEntry, err := s.vpcKV.Get(vpcID)
+	// Verify VPC exists and belongs to this account
+	vpcEntry, err := s.vpcKV.Get(accountKey(accountID, vpcID))
 	if err != nil {
 		return nil, errors.New(awserrors.ErrorInvalidVpcIDNotFound)
 	}
@@ -397,14 +413,18 @@ func (s *VPCServiceImpl) CreateSubnet(input *ec2.CreateSubnetInput) (*ec2.Create
 		return nil, errors.New(awserrors.ErrorInvalidSubnetRange)
 	}
 
-	// Check for CIDR conflicts with existing subnets in this VPC
+	// Check for CIDR conflicts with existing subnets in this VPC (same account)
+	prefix := accountID + "."
 	subnetKeys, err := s.subnetKV.Keys()
 	if err != nil && !errors.Is(err, nats.ErrNoKeysFound) {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	for _, key := range subnetKeys {
-		entry, err := s.subnetKV.Get(key)
+	for _, k := range subnetKeys {
+		if !strings.HasPrefix(k, prefix) {
+			continue
+		}
+		entry, err := s.subnetKV.Get(k)
 		if err != nil {
 			continue
 		}
@@ -463,22 +483,22 @@ func (s *VPCServiceImpl) CreateSubnet(input *ec2.CreateSubnetInput) (*ec2.Create
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal subnet record: %w", err)
 	}
-	if _, err := s.subnetKV.Put(subnetID, data); err != nil {
+	if _, err := s.subnetKV.Put(accountKey(accountID, subnetID), data); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("CreateSubnet completed", "subnetId", subnetID, "vpcId", vpcID, "cidrBlock", record.CidrBlock)
+	slog.Info("CreateSubnet completed", "subnetId", subnetID, "vpcId", vpcID, "cidrBlock", record.CidrBlock, "accountID", accountID)
 
 	// Publish vpc.create-subnet event for vpcd topology translation
 	s.publishSubnetEvent("vpc.create-subnet", record.SubnetId, record.VpcId, record.CidrBlock)
 
 	return &ec2.CreateSubnetOutput{
-		Subnet: s.subnetRecordToEC2(&record, totalHosts),
+		Subnet: s.subnetRecordToEC2(&record, totalHosts, accountID),
 	}, nil
 }
 
 // DeleteSubnet deletes a subnet
-func (s *VPCServiceImpl) DeleteSubnet(input *ec2.DeleteSubnetInput) (*ec2.DeleteSubnetOutput, error) {
+func (s *VPCServiceImpl) DeleteSubnet(input *ec2.DeleteSubnetInput, accountID string) (*ec2.DeleteSubnetOutput, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -487,20 +507,21 @@ func (s *VPCServiceImpl) DeleteSubnet(input *ec2.DeleteSubnetInput) (*ec2.Delete
 	}
 
 	subnetID := *input.SubnetId
+	key := accountKey(accountID, subnetID)
 
 	// Read subnet record before deletion (needed for vpcd event)
-	subnetEntry, err := s.subnetKV.Get(subnetID)
+	subnetEntry, err := s.subnetKV.Get(key)
 	if err != nil {
 		return nil, errors.New(awserrors.ErrorInvalidSubnetIDNotFound)
 	}
 	var subnetRecord SubnetRecord
 	_ = json.Unmarshal(subnetEntry.Value(), &subnetRecord)
 
-	if err := s.subnetKV.Delete(subnetID); err != nil {
+	if err := s.subnetKV.Delete(key); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
-	slog.Info("DeleteSubnet completed", "subnetId", subnetID)
+	slog.Info("DeleteSubnet completed", "subnetId", subnetID, "accountID", accountID)
 
 	// Publish vpc.delete-subnet event for vpcd topology cleanup
 	s.publishSubnetEvent("vpc.delete-subnet", subnetID, subnetRecord.VpcId, subnetRecord.CidrBlock)
@@ -509,7 +530,7 @@ func (s *VPCServiceImpl) DeleteSubnet(input *ec2.DeleteSubnetInput) (*ec2.Delete
 }
 
 // DescribeSubnets describes subnets
-func (s *VPCServiceImpl) DescribeSubnets(input *ec2.DescribeSubnetsInput) (*ec2.DescribeSubnetsOutput, error) {
+func (s *VPCServiceImpl) DescribeSubnets(input *ec2.DescribeSubnetsInput, accountID string) (*ec2.DescribeSubnetsOutput, error) {
 	if err := s.ensureKVReady(); err != nil {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
@@ -530,13 +551,14 @@ func (s *VPCServiceImpl) DescribeSubnets(input *ec2.DescribeSubnetsInput) (*ec2.
 		}
 	}
 
+	prefix := accountID + "."
 	keys, err := s.subnetKV.Keys()
 	if err != nil && !errors.Is(err, nats.ErrNoKeysFound) {
 		return nil, errors.New(awserrors.ErrorServerInternal)
 	}
 
 	for _, key := range keys {
-		if len(subnetIDs) > 0 && !subnetIDs[key] {
+		if !strings.HasPrefix(key, prefix) {
 			continue
 		}
 
@@ -552,6 +574,10 @@ func (s *VPCServiceImpl) DescribeSubnets(input *ec2.DescribeSubnetsInput) (*ec2.
 			continue
 		}
 
+		if len(subnetIDs) > 0 && !subnetIDs[record.SubnetId] {
+			continue
+		}
+
 		// Apply VPC ID filter
 		if vpcIDFilter != "" && record.VpcId != vpcIDFilter {
 			continue
@@ -565,7 +591,7 @@ func (s *VPCServiceImpl) DescribeSubnets(input *ec2.DescribeSubnetsInput) (*ec2.
 			availableIPs = max((1<<(32-ones))-5, 0) //#nosec G115 - ones from validated CIDR
 		}
 
-		subnets = append(subnets, s.subnetRecordToEC2(&record, availableIPs))
+		subnets = append(subnets, s.subnetRecordToEC2(&record, availableIPs, accountID))
 	}
 
 	// If specific subnet IDs were requested but not found, return error
@@ -583,20 +609,20 @@ func (s *VPCServiceImpl) DescribeSubnets(input *ec2.DescribeSubnetsInput) (*ec2.
 		}
 	}
 
-	slog.Info("DescribeSubnets completed", "count", len(subnets))
+	slog.Info("DescribeSubnets completed", "count", len(subnets), "accountID", accountID)
 
 	return &ec2.DescribeSubnetsOutput{
 		Subnets: subnets,
 	}, nil
 }
 
-func (s *VPCServiceImpl) vpcRecordToEC2(record *VPCRecord) *ec2.Vpc {
+func (s *VPCServiceImpl) vpcRecordToEC2(record *VPCRecord, accountID string) *ec2.Vpc {
 	vpc := &ec2.Vpc{
 		VpcId:     aws.String(record.VpcId),
 		CidrBlock: aws.String(record.CidrBlock),
 		State:     aws.String(record.State),
 		IsDefault: aws.Bool(record.IsDefault),
-		OwnerId:   aws.String("123456789012"),
+		OwnerId:   aws.String(accountID),
 		CidrBlockAssociationSet: []*ec2.VpcCidrBlockAssociation{
 			{
 				CidrBlock: aws.String(record.CidrBlock),
@@ -621,7 +647,7 @@ func (s *VPCServiceImpl) vpcRecordToEC2(record *VPCRecord) *ec2.Vpc {
 	return vpc
 }
 
-func (s *VPCServiceImpl) subnetRecordToEC2(record *SubnetRecord, availableIPs int) *ec2.Subnet {
+func (s *VPCServiceImpl) subnetRecordToEC2(record *SubnetRecord, availableIPs int, accountID string) *ec2.Subnet {
 	subnet := &ec2.Subnet{
 		SubnetId:                aws.String(record.SubnetId),
 		VpcId:                   aws.String(record.VpcId),
@@ -630,7 +656,7 @@ func (s *VPCServiceImpl) subnetRecordToEC2(record *SubnetRecord, availableIPs in
 		State:                   aws.String(record.State),
 		DefaultForAz:            aws.Bool(record.IsDefault),
 		AvailableIpAddressCount: aws.Int64(int64(availableIPs)),
-		OwnerId:                 aws.String("123456789012"),
+		OwnerId:                 aws.String(accountID),
 		MapPublicIpOnLaunch:     aws.Bool(false),
 	}
 
@@ -651,21 +677,30 @@ const (
 	DefaultSubnetCidr = "172.31.0.0/20"
 )
 
-// EnsureDefaultVPC creates a default VPC and subnet if none exists.
+// GlobalAccountID is used for resources created without an explicit account context
+// (e.g., default VPC at daemon startup). Pre-existing resources with no accountID
+// are treated as owned by this account.
+const GlobalAccountID = "000000000000"
+
+// EnsureDefaultVPC creates a default VPC and subnet if none exists for the given account.
 // This matches AWS behavior where a default VPC is present on account creation.
 // Safe to call multiple times — no-ops if a default VPC already exists.
-func (s *VPCServiceImpl) EnsureDefaultVPC() error {
+func (s *VPCServiceImpl) EnsureDefaultVPC(accountID string) error {
 	if s.vpcKV == nil {
 		return nil // No persistence, skip
 	}
 
-	// Check if a default VPC already exists
+	// Check if a default VPC already exists for this account
+	prefix := accountID + "."
 	keys, err := s.vpcKV.Keys()
 	if err != nil && !errors.Is(err, nats.ErrNoKeysFound) {
 		return fmt.Errorf("list VPCs: %w", err)
 	}
 
 	for _, key := range keys {
+		if !strings.HasPrefix(key, prefix) {
+			continue
+		}
 		entry, err := s.vpcKV.Get(key)
 		if err != nil {
 			continue
@@ -675,7 +710,7 @@ func (s *VPCServiceImpl) EnsureDefaultVPC() error {
 			continue
 		}
 		if record.IsDefault {
-			slog.Debug("Default VPC already exists", "vpcId", record.VpcId)
+			slog.Debug("Default VPC already exists", "vpcId", record.VpcId, "accountID", accountID)
 			return nil
 		}
 	}
@@ -701,7 +736,7 @@ func (s *VPCServiceImpl) EnsureDefaultVPC() error {
 	if err != nil {
 		return fmt.Errorf("marshal default VPC: %w", err)
 	}
-	if _, err := s.vpcKV.Put(vpcID, data); err != nil {
+	if _, err := s.vpcKV.Put(accountKey(accountID, vpcID), data); err != nil {
 		return fmt.Errorf("store default VPC: %w", err)
 	}
 
@@ -730,7 +765,7 @@ func (s *VPCServiceImpl) EnsureDefaultVPC() error {
 	if err != nil {
 		return fmt.Errorf("marshal default subnet: %w", err)
 	}
-	if _, err := s.subnetKV.Put(subnetID, data); err != nil {
+	if _, err := s.subnetKV.Put(accountKey(accountID, subnetID), data); err != nil {
 		return fmt.Errorf("store default subnet: %w", err)
 	}
 
@@ -742,16 +777,18 @@ func (s *VPCServiceImpl) EnsureDefaultVPC() error {
 		"subnetId", subnetID,
 		"subnetCidr", DefaultSubnetCidr,
 		"az", az,
+		"accountID", accountID,
 	)
 	return nil
 }
 
 // GetDefaultSubnet returns the default subnet for RunInstances when no SubnetId is specified.
-func (s *VPCServiceImpl) GetDefaultSubnet() (*SubnetRecord, error) {
+func (s *VPCServiceImpl) GetDefaultSubnet(accountID string) (*SubnetRecord, error) {
 	if s.subnetKV == nil {
 		return nil, fmt.Errorf("VPC service not initialized")
 	}
 
+	prefix := accountID + "."
 	keys, err := s.subnetKV.Keys()
 	if err != nil {
 		if errors.Is(err, nats.ErrNoKeysFound) {
@@ -761,6 +798,9 @@ func (s *VPCServiceImpl) GetDefaultSubnet() (*SubnetRecord, error) {
 	}
 
 	for _, key := range keys {
+		if !strings.HasPrefix(key, prefix) {
+			continue
+		}
 		entry, err := s.subnetKV.Get(key)
 		if err != nil {
 			continue
diff --git a/hive/handlers/ec2/vpc/service_impl_test.go b/hive/handlers/ec2/vpc/service_impl_test.go
index 0e77b6dda..9b0cf3f56 100644
--- a/hive/handlers/ec2/vpc/service_impl_test.go
+++ b/hive/handlers/ec2/vpc/service_impl_test.go
@@ -13,6 +13,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+const testAccountID = "123456789012"
+
 func setupTestVPCServiceWithNC(t *testing.T) (*VPCServiceImpl, *nats.Conn) {
 	t.Helper()
 	opts := &server.Options{
@@ -48,7 +50,7 @@ func createTestVPC(t *testing.T, svc *VPCServiceImpl, cidr string) string {
 	t.Helper()
 	out, err := svc.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String(cidr),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	return *out.Vpc.VpcId
 }
@@ -58,7 +60,7 @@ func createTestSubnet(t *testing.T, svc *VPCServiceImpl, vpcID, cidr string) str
 	out, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String(vpcID),
 		CidrBlock: aws.String(cidr),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	return *out.Subnet.SubnetId
 }
@@ -69,7 +71,7 @@ func TestCreateVpc(t *testing.T) {
 	svc := setupTestVPCService(t)
 	out, err := svc.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out.Vpc)
 	assert.Equal(t, "vpc-", (*out.Vpc.VpcId)[:4])
@@ -80,7 +82,7 @@ func TestCreateVpc(t *testing.T) {
 
 func TestCreateVpc_MissingCidr(t *testing.T) {
 	svc := setupTestVPCService(t)
-	_, err := svc.CreateVpc(&ec2.CreateVpcInput{})
+	_, err := svc.CreateVpc(&ec2.CreateVpcInput{}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -88,7 +90,7 @@ func TestCreateVpc_EmptyCidr(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String(""),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -96,7 +98,7 @@ func TestCreateVpc_InvalidCidr(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("not-a-cidr"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidVpcRange")
 }
 
@@ -104,7 +106,7 @@ func TestCreateVpc_CidrTooLarge(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/8"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidVpcRange")
 }
 
@@ -112,7 +114,7 @@ func TestCreateVpc_CidrTooSmall(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/29"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidVpcRange")
 }
 
@@ -129,14 +131,14 @@ func TestCreateVpc_WithTags(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, out.Vpc.Tags, 2)
 
 	// Verify tags persist through describe
 	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{
 		VpcIds: []*string{out.Vpc.VpcId},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.Vpcs, 1)
 	assert.Len(t, desc.Vpcs[0].Tags, 2)
@@ -154,7 +156,7 @@ func TestCreateVpc_TagsWrongResourceType(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, out.Vpc.Tags)
 }
@@ -163,9 +165,9 @@ func TestCreateVpc_VNIIncrement(t *testing.T) {
 	svc := setupTestVPCService(t)
 
 	// Create two VPCs and verify they get different VNIs
-	out1, err := svc.CreateVpc(&ec2.CreateVpcInput{CidrBlock: aws.String("10.0.0.0/16")})
+	out1, err := svc.CreateVpc(&ec2.CreateVpcInput{CidrBlock: aws.String("10.0.0.0/16")}, testAccountID)
 	require.NoError(t, err)
-	out2, err := svc.CreateVpc(&ec2.CreateVpcInput{CidrBlock: aws.String("10.1.0.0/16")})
+	out2, err := svc.CreateVpc(&ec2.CreateVpcInput{CidrBlock: aws.String("10.1.0.0/16")}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify VPCs are different
@@ -178,13 +180,13 @@ func TestDeleteVpc(t *testing.T) {
 
 	_, err := svc.DeleteVpc(&ec2.DeleteVpcInput{
 		VpcId: aws.String(vpcID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify deleted
 	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{
 		VpcIds: []*string{aws.String(vpcID)},
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidVpcID.NotFound")
 	assert.Nil(t, desc)
 }
@@ -193,13 +195,13 @@ func TestDeleteVpc_NotFound(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.DeleteVpc(&ec2.DeleteVpcInput{
 		VpcId: aws.String("vpc-nonexistent"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidVpcID.NotFound")
 }
 
 func TestDeleteVpc_MissingID(t *testing.T) {
 	svc := setupTestVPCService(t)
-	_, err := svc.DeleteVpc(&ec2.DeleteVpcInput{})
+	_, err := svc.DeleteVpc(&ec2.DeleteVpcInput{}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -211,7 +213,7 @@ func TestDeleteVpc_WithSubnets(t *testing.T) {
 	// Should fail because VPC has subnets
 	_, err := svc.DeleteVpc(&ec2.DeleteVpcInput{
 		VpcId: aws.String(vpcID),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "DependencyViolation")
 }
 
@@ -220,7 +222,7 @@ func TestDescribeVpcs_All(t *testing.T) {
 	createTestVPC(t, svc, "10.0.0.0/16")
 	createTestVPC(t, svc, "10.1.0.0/16")
 
-	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{})
+	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, desc.Vpcs, 2)
 }
@@ -232,7 +234,7 @@ func TestDescribeVpcs_ByID(t *testing.T) {
 
 	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{
 		VpcIds: []*string{aws.String(vpcID)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.Vpcs, 1)
 	assert.Equal(t, vpcID, *desc.Vpcs[0].VpcId)
@@ -240,7 +242,7 @@ func TestDescribeVpcs_ByID(t *testing.T) {
 
 func TestDescribeVpcs_Empty(t *testing.T) {
 	svc := setupTestVPCService(t)
-	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{})
+	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, desc.Vpcs)
 }
@@ -249,7 +251,7 @@ func TestDescribeVpcs_NotFound(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{
 		VpcIds: []*string{aws.String("vpc-nonexistent")},
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidVpcID.NotFound")
 }
 
@@ -262,7 +264,7 @@ func TestCreateSubnet(t *testing.T) {
 	out, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String(vpcID),
 		CidrBlock: aws.String("10.0.1.0/24"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out.Subnet)
 	assert.Equal(t, "subnet-", (*out.Subnet.SubnetId)[:7])
@@ -277,7 +279,7 @@ func TestCreateSubnet_MissingVpcId(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		CidrBlock: aws.String("10.0.1.0/24"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -286,7 +288,7 @@ func TestCreateSubnet_MissingCidr(t *testing.T) {
 	vpcID := createTestVPC(t, svc, "10.0.0.0/16")
 	_, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId: aws.String(vpcID),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -295,7 +297,7 @@ func TestCreateSubnet_InvalidVpcId(t *testing.T) {
 	_, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String("vpc-nonexistent"),
 		CidrBlock: aws.String("10.0.1.0/24"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidVpcID.NotFound")
 }
 
@@ -305,7 +307,7 @@ func TestCreateSubnet_InvalidCidr(t *testing.T) {
 	_, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String(vpcID),
 		CidrBlock: aws.String("not-a-cidr"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidSubnet.Range")
 }
 
@@ -315,7 +317,7 @@ func TestCreateSubnet_OutsideVpcCidr(t *testing.T) {
 	_, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String(vpcID),
 		CidrBlock: aws.String("192.168.1.0/24"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidSubnet.Range")
 }
 
@@ -328,7 +330,7 @@ func TestCreateSubnet_ConflictingCidr(t *testing.T) {
 	_, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String(vpcID),
 		CidrBlock: aws.String("10.0.1.0/25"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidSubnet.Conflict")
 }
 
@@ -347,7 +349,7 @@ func TestCreateSubnet_WithTags(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, out.Subnet.Tags, 1)
 }
@@ -360,7 +362,7 @@ func TestCreateSubnet_WithAZ(t *testing.T) {
 		VpcId:            aws.String(vpcID),
 		CidrBlock:        aws.String("10.0.1.0/24"),
 		AvailabilityZone: aws.String("us-east-1a"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, "us-east-1a", *out.Subnet.AvailabilityZone)
 }
@@ -372,13 +374,13 @@ func TestDeleteSubnet(t *testing.T) {
 
 	_, err := svc.DeleteSubnet(&ec2.DeleteSubnetInput{
 		SubnetId: aws.String(subnetID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Verify deleted
 	desc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{
 		SubnetIds: []*string{aws.String(subnetID)},
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidSubnetID.NotFound")
 	assert.Nil(t, desc)
 }
@@ -387,13 +389,13 @@ func TestDeleteSubnet_NotFound(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.DeleteSubnet(&ec2.DeleteSubnetInput{
 		SubnetId: aws.String("subnet-nonexistent"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidSubnetID.NotFound")
 }
 
 func TestDeleteSubnet_MissingID(t *testing.T) {
 	svc := setupTestVPCService(t)
-	_, err := svc.DeleteSubnet(&ec2.DeleteSubnetInput{})
+	_, err := svc.DeleteSubnet(&ec2.DeleteSubnetInput{}, testAccountID)
 	assert.ErrorContains(t, err, "MissingParameter")
 }
 
@@ -403,7 +405,7 @@ func TestDescribeSubnets_All(t *testing.T) {
 	createTestSubnet(t, svc, vpcID, "10.0.1.0/24")
 	createTestSubnet(t, svc, vpcID, "10.0.2.0/24")
 
-	desc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{})
+	desc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, desc.Subnets, 2)
 }
@@ -416,7 +418,7 @@ func TestDescribeSubnets_ByID(t *testing.T) {
 
 	desc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{
 		SubnetIds: []*string{aws.String(subnetID)},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.Subnets, 1)
 	assert.Equal(t, subnetID, *desc.Subnets[0].SubnetId)
@@ -436,7 +438,7 @@ func TestDescribeSubnets_ByVpcId(t *testing.T) {
 				Values: []*string{aws.String(vpc1)},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.Subnets, 1)
 	assert.Equal(t, vpc1, *desc.Subnets[0].VpcId)
@@ -444,7 +446,7 @@ func TestDescribeSubnets_ByVpcId(t *testing.T) {
 
 func TestDescribeSubnets_Empty(t *testing.T) {
 	svc := setupTestVPCService(t)
-	desc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{})
+	desc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, desc.Subnets)
 }
@@ -453,7 +455,7 @@ func TestDescribeSubnets_NotFound(t *testing.T) {
 	svc := setupTestVPCService(t)
 	_, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{
 		SubnetIds: []*string{aws.String("subnet-nonexistent")},
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidSubnetID.NotFound")
 }
 
@@ -473,7 +475,7 @@ func TestCreateMultipleSubnetsInVpc(t *testing.T) {
 		Filters: []*ec2.Filter{
 			{Name: aws.String("vpc-id"), Values: []*string{aws.String(vpcID)}},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, desc.Subnets, 3)
 }
@@ -484,15 +486,15 @@ func TestDeleteVpcAfterSubnetsDeleted(t *testing.T) {
 	subnetID := createTestSubnet(t, svc, vpcID, "10.0.1.0/24")
 
 	// Can't delete VPC with subnets
-	_, err := svc.DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String(vpcID)})
+	_, err := svc.DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String(vpcID)}, testAccountID)
 	assert.ErrorContains(t, err, "DependencyViolation")
 
 	// Delete subnet first
-	_, err = svc.DeleteSubnet(&ec2.DeleteSubnetInput{SubnetId: aws.String(subnetID)})
+	_, err = svc.DeleteSubnet(&ec2.DeleteSubnetInput{SubnetId: aws.String(subnetID)}, testAccountID)
 	require.NoError(t, err)
 
 	// Now VPC can be deleted
-	_, err = svc.DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String(vpcID)})
+	_, err = svc.DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String(vpcID)}, testAccountID)
 	require.NoError(t, err)
 }
 
@@ -504,7 +506,7 @@ func TestCreateSubnet_CidrRanges(t *testing.T) {
 	out, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String(vpcID),
 		CidrBlock: aws.String("10.0.0.0/28"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, int64(11), *out.Subnet.AvailableIpAddressCount)
 
@@ -513,7 +515,7 @@ func TestCreateSubnet_CidrRanges(t *testing.T) {
 	out2, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String(vpcID2),
 		CidrBlock: aws.String("172.16.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, int64(65531), *out2.Subnet.AvailableIpAddressCount)
 }
@@ -523,18 +525,18 @@ func TestCreateSubnet_CidrRanges(t *testing.T) {
 func TestEnsureDefaultVPC(t *testing.T) {
 	svc := setupTestVPCService(t)
 
-	err := svc.EnsureDefaultVPC()
+	err := svc.EnsureDefaultVPC(testAccountID)
 	require.NoError(t, err)
 
 	// Verify default VPC was created
-	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{})
+	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, desc.Vpcs, 1)
 	assert.True(t, *desc.Vpcs[0].IsDefault)
 	assert.Equal(t, "172.31.0.0/16", *desc.Vpcs[0].CidrBlock)
 
 	// Verify default subnet was created
-	subDesc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{})
+	subDesc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, subDesc.Subnets, 1)
 	assert.True(t, *subDesc.Subnets[0].DefaultForAz)
@@ -546,15 +548,15 @@ func TestEnsureDefaultVPC_Idempotent(t *testing.T) {
 	svc := setupTestVPCService(t)
 
 	// Call twice — should be idempotent
-	require.NoError(t, svc.EnsureDefaultVPC())
-	require.NoError(t, svc.EnsureDefaultVPC())
+	require.NoError(t, svc.EnsureDefaultVPC(testAccountID))
+	require.NoError(t, svc.EnsureDefaultVPC(testAccountID))
 
 	// Should still have exactly 1 VPC and 1 subnet
-	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{})
+	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, desc.Vpcs, 1)
 
-	subDesc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{})
+	subDesc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, subDesc.Subnets, 1)
 }
@@ -563,15 +565,15 @@ func TestEnsureDefaultVPC_SkipsWhenDefaultExists(t *testing.T) {
 	svc := setupTestVPCService(t)
 
 	// Create default VPC first
-	require.NoError(t, svc.EnsureDefaultVPC())
+	require.NoError(t, svc.EnsureDefaultVPC(testAccountID))
 
 	// Create a second (non-default) VPC
 	createTestVPC(t, svc, "10.0.0.0/16")
 
 	// Calling again should not create another default
-	require.NoError(t, svc.EnsureDefaultVPC())
+	require.NoError(t, svc.EnsureDefaultVPC(testAccountID))
 
-	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{})
+	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, desc.Vpcs, 2) // 1 default + 1 manual
 
@@ -589,13 +591,13 @@ func TestGetDefaultSubnet(t *testing.T) {
 	svc := setupTestVPCService(t)
 
 	// No default subnet yet
-	_, err := svc.GetDefaultSubnet()
+	_, err := svc.GetDefaultSubnet(testAccountID)
 	assert.Error(t, err)
 
 	// Create default VPC + subnet
-	require.NoError(t, svc.EnsureDefaultVPC())
+	require.NoError(t, svc.EnsureDefaultVPC(testAccountID))
 
-	subnet, err := svc.GetDefaultSubnet()
+	subnet, err := svc.GetDefaultSubnet(testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, "172.31.0.0/20", subnet.CidrBlock)
 	assert.True(t, subnet.IsDefault)
@@ -609,12 +611,12 @@ func TestGetDefaultSubnet_NotConfusedByNonDefault(t *testing.T) {
 	createTestSubnet(t, svc, vpcID, "10.0.1.0/24")
 
 	// GetDefaultSubnet should not return the non-default subnet
-	_, err := svc.GetDefaultSubnet()
+	_, err := svc.GetDefaultSubnet(testAccountID)
 	assert.Error(t, err)
 
 	// Now create default
-	require.NoError(t, svc.EnsureDefaultVPC())
-	subnet, err := svc.GetDefaultSubnet()
+	require.NoError(t, svc.EnsureDefaultVPC(testAccountID))
+	subnet, err := svc.GetDefaultSubnet(testAccountID)
 	require.NoError(t, err)
 	assert.True(t, subnet.IsDefault)
 }
@@ -625,7 +627,7 @@ func TestCreateSubnet_CidrTooSmall(t *testing.T) {
 	_, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String(vpcID),
 		CidrBlock: aws.String("10.0.0.0/29"),
-	})
+	}, testAccountID)
 	assert.ErrorContains(t, err, "InvalidSubnet.Range")
 }
 
@@ -633,7 +635,7 @@ func TestVpcCidrBlockAssociation(t *testing.T) {
 	svc := setupTestVPCService(t)
 	out, err := svc.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, out.Vpc.CidrBlockAssociationSet, 1)
 	assert.Equal(t, "10.0.0.0/16", *out.Vpc.CidrBlockAssociationSet[0].CidrBlock)
@@ -644,21 +646,21 @@ func TestVpcCidrBlockAssociation(t *testing.T) {
 
 func TestKVNilGuard_CreateVpc(t *testing.T) {
 	svc := NewVPCServiceImpl(nil) // in-memory fallback, all KV fields nil
-	_, err := svc.CreateVpc(&ec2.CreateVpcInput{CidrBlock: aws.String("10.0.0.0/16")})
+	_, err := svc.CreateVpc(&ec2.CreateVpcInput{CidrBlock: aws.String("10.0.0.0/16")}, testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "ServerInternal")
 }
 
 func TestKVNilGuard_DeleteVpc(t *testing.T) {
 	svc := NewVPCServiceImpl(nil)
-	_, err := svc.DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String("vpc-123")})
+	_, err := svc.DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String("vpc-123")}, testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "ServerInternal")
 }
 
 func TestKVNilGuard_DescribeVpcs(t *testing.T) {
 	svc := NewVPCServiceImpl(nil)
-	_, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{})
+	_, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{}, testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "ServerInternal")
 }
@@ -668,42 +670,42 @@ func TestKVNilGuard_CreateSubnet(t *testing.T) {
 	_, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String("vpc-123"),
 		CidrBlock: aws.String("10.0.1.0/24"),
-	})
+	}, testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "ServerInternal")
 }
 
 func TestKVNilGuard_DeleteSubnet(t *testing.T) {
 	svc := NewVPCServiceImpl(nil)
-	_, err := svc.DeleteSubnet(&ec2.DeleteSubnetInput{SubnetId: aws.String("subnet-123")})
+	_, err := svc.DeleteSubnet(&ec2.DeleteSubnetInput{SubnetId: aws.String("subnet-123")}, testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "ServerInternal")
 }
 
 func TestKVNilGuard_DescribeSubnets(t *testing.T) {
 	svc := NewVPCServiceImpl(nil)
-	_, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{})
+	_, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{}, testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "ServerInternal")
 }
 
 func TestKVNilGuard_CreateNetworkInterface(t *testing.T) {
 	svc := NewVPCServiceImpl(nil)
-	_, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{SubnetId: aws.String("subnet-123")})
+	_, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{SubnetId: aws.String("subnet-123")}, testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "ServerInternal")
 }
 
 func TestKVNilGuard_DeleteNetworkInterface(t *testing.T) {
 	svc := NewVPCServiceImpl(nil)
-	_, err := svc.DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{NetworkInterfaceId: aws.String("eni-123")})
+	_, err := svc.DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{NetworkInterfaceId: aws.String("eni-123")}, testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "ServerInternal")
 }
 
 func TestKVNilGuard_DescribeNetworkInterfaces(t *testing.T) {
 	svc := NewVPCServiceImpl(nil)
-	_, err := svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{})
+	_, err := svc.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{}, testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "ServerInternal")
 }
@@ -718,7 +720,7 @@ func TestDescribeVpcs_NilFields(t *testing.T) {
 	desc, err := svc.DescribeVpcs(&ec2.DescribeVpcsInput{
 		VpcIds:  nil,
 		Filters: nil,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Len(t, desc.Vpcs, 1)
 }
@@ -736,7 +738,7 @@ func TestDescribeSubnets_FilterByVpcId_NoMatch(t *testing.T) {
 				Values: []*string{aws.String("vpc-nonexistent")},
 			},
 		},
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Empty(t, desc.Subnets)
 }
@@ -755,7 +757,7 @@ func TestCreateVpc_PublishesEvent(t *testing.T) {
 
 	out, err := svc.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	vpcID := *out.Vpc.VpcId
 
@@ -781,7 +783,7 @@ func TestDeleteVpc_PublishesEvent(t *testing.T) {
 
 	_, err = svc.DeleteVpc(&ec2.DeleteVpcInput{
 		VpcId: aws.String(vpcID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	select {
@@ -806,7 +808,7 @@ func TestCreateSubnet_PublishesEvent(t *testing.T) {
 	out, err := svc.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     aws.String(vpcID),
 		CidrBlock: aws.String("10.0.1.0/24"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	subnetID := *out.Subnet.SubnetId
 
@@ -833,7 +835,7 @@ func TestDeleteSubnet_PublishesEvent(t *testing.T) {
 
 	_, err = svc.DeleteSubnet(&ec2.DeleteSubnetInput{
 		SubnetId: aws.String(subnetID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	select {
@@ -871,11 +873,11 @@ func TestEnsureDefaultVPC_WithConfigAZ(t *testing.T) {
 	svc, err := NewVPCServiceImplWithNATS(cfg, nc)
 	require.NoError(t, err)
 
-	err = svc.EnsureDefaultVPC()
+	err = svc.EnsureDefaultVPC(testAccountID)
 	require.NoError(t, err)
 
 	// Verify the subnet uses the configured AZ
-	subDesc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{})
+	subDesc, err := svc.DescribeSubnets(&ec2.DescribeSubnetsInput{}, testAccountID)
 	require.NoError(t, err)
 	require.Len(t, subDesc.Subnets, 1)
 	assert.Equal(t, "us-west-2b", *subDesc.Subnets[0].AvailabilityZone)
@@ -884,7 +886,7 @@ func TestEnsureDefaultVPC_WithConfigAZ(t *testing.T) {
 func TestGetDefaultSubnet_NoKV(t *testing.T) {
 	// Service without KV should return error
 	svc := NewVPCServiceImpl(nil)
-	_, err := svc.GetDefaultSubnet()
+	_, err := svc.GetDefaultSubnet(testAccountID)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "not initialized")
 }
@@ -894,7 +896,7 @@ func TestCreateVpc_NormalizesNetworkCidr(t *testing.T) {
 	// Pass a CIDR with host bits set — should be normalized to network address
 	out, err := svc.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.5/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	// Should normalize to 10.0.0.0/16
 	assert.Equal(t, "10.0.0.0/16", *out.Vpc.CidrBlock)
@@ -908,17 +910,17 @@ func TestDeleteVpc_WithENIs(t *testing.T) {
 	// Create an ENI in the subnet
 	_, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: aws.String(subnetID),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Delete subnet should succeed (ENI is in subnet but delete checks subnet dependencies in vpc delete)
 	// First delete subnet
-	_, err = svc.DeleteSubnet(&ec2.DeleteSubnetInput{SubnetId: aws.String(subnetID)})
+	_, err = svc.DeleteSubnet(&ec2.DeleteSubnetInput{SubnetId: aws.String(subnetID)}, testAccountID)
 	// DeleteSubnet doesn't check for ENIs currently - just deletes
 	require.NoError(t, err)
 
 	// Now delete VPC should succeed since subnet is gone
-	_, err = svc.DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String(vpcID)})
+	_, err = svc.DeleteVpc(&ec2.DeleteVpcInput{VpcId: aws.String(vpcID)}, testAccountID)
 	require.NoError(t, err)
 }
 
@@ -930,20 +932,20 @@ func TestCreateNetworkInterface_WithExplicitIP(t *testing.T) {
 	out, err := svc.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId:         aws.String(subnetID),
 		PrivateIpAddress: aws.String("10.0.1.100"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	assert.Equal(t, "10.0.1.100", *out.NetworkInterface.PrivateIpAddress)
 }
 
 func TestAttachENI_NotFound(t *testing.T) {
 	svc := setupTestVPCService(t)
-	_, err := svc.AttachENI("eni-nonexistent", "i-test", 0)
+	_, err := svc.AttachENI(testAccountID, "eni-nonexistent", "i-test", 0)
 	assert.ErrorContains(t, err, "InvalidNetworkInterfaceID.NotFound")
 }
 
 func TestDetachENI_NotFound(t *testing.T) {
 	svc := setupTestVPCService(t)
-	err := svc.DetachENI("eni-nonexistent")
+	err := svc.DetachENI(testAccountID, "eni-nonexistent")
 	assert.ErrorContains(t, err, "InvalidNetworkInterfaceID.NotFound")
 }
 
@@ -961,7 +963,7 @@ func TestEnsureDefaultVPC_PublishesEvents(t *testing.T) {
 	require.NoError(t, err)
 	defer func() { _ = subSub.Unsubscribe() }()
 
-	err = svc.EnsureDefaultVPC()
+	err = svc.EnsureDefaultVPC(testAccountID)
 	require.NoError(t, err)
 
 	// Should publish vpc.create event
diff --git a/hive/handlers/ec2/vpc/service_nats.go b/hive/handlers/ec2/vpc/service_nats.go
index a546c30d4..0313d17f2 100644
--- a/hive/handlers/ec2/vpc/service_nats.go
+++ b/hive/handlers/ec2/vpc/service_nats.go
@@ -18,38 +18,38 @@ func NewNATSVPCService(conn *nats.Conn) VPCService {
 	return &NATSVPCService{natsConn: conn}
 }
 
-func (s *NATSVPCService) CreateVpc(input *ec2.CreateVpcInput) (*ec2.CreateVpcOutput, error) {
-	return utils.NATSRequest[ec2.CreateVpcOutput](s.natsConn, "ec2.CreateVpc", input, 30*time.Second)
+func (s *NATSVPCService) CreateVpc(input *ec2.CreateVpcInput, accountID string) (*ec2.CreateVpcOutput, error) {
+	return utils.NATSRequest[ec2.CreateVpcOutput](s.natsConn, "ec2.CreateVpc", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVPCService) DeleteVpc(input *ec2.DeleteVpcInput) (*ec2.DeleteVpcOutput, error) {
-	return utils.NATSRequest[ec2.DeleteVpcOutput](s.natsConn, "ec2.DeleteVpc", input, 30*time.Second)
+func (s *NATSVPCService) DeleteVpc(input *ec2.DeleteVpcInput, accountID string) (*ec2.DeleteVpcOutput, error) {
+	return utils.NATSRequest[ec2.DeleteVpcOutput](s.natsConn, "ec2.DeleteVpc", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVPCService) DescribeVpcs(input *ec2.DescribeVpcsInput) (*ec2.DescribeVpcsOutput, error) {
-	return utils.NATSRequest[ec2.DescribeVpcsOutput](s.natsConn, "ec2.DescribeVpcs", input, 30*time.Second)
+func (s *NATSVPCService) DescribeVpcs(input *ec2.DescribeVpcsInput, accountID string) (*ec2.DescribeVpcsOutput, error) {
+	return utils.NATSRequest[ec2.DescribeVpcsOutput](s.natsConn, "ec2.DescribeVpcs", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVPCService) CreateSubnet(input *ec2.CreateSubnetInput) (*ec2.CreateSubnetOutput, error) {
-	return utils.NATSRequest[ec2.CreateSubnetOutput](s.natsConn, "ec2.CreateSubnet", input, 30*time.Second)
+func (s *NATSVPCService) CreateSubnet(input *ec2.CreateSubnetInput, accountID string) (*ec2.CreateSubnetOutput, error) {
+	return utils.NATSRequest[ec2.CreateSubnetOutput](s.natsConn, "ec2.CreateSubnet", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVPCService) DeleteSubnet(input *ec2.DeleteSubnetInput) (*ec2.DeleteSubnetOutput, error) {
-	return utils.NATSRequest[ec2.DeleteSubnetOutput](s.natsConn, "ec2.DeleteSubnet", input, 30*time.Second)
+func (s *NATSVPCService) DeleteSubnet(input *ec2.DeleteSubnetInput, accountID string) (*ec2.DeleteSubnetOutput, error) {
+	return utils.NATSRequest[ec2.DeleteSubnetOutput](s.natsConn, "ec2.DeleteSubnet", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVPCService) DescribeSubnets(input *ec2.DescribeSubnetsInput) (*ec2.DescribeSubnetsOutput, error) {
-	return utils.NATSRequest[ec2.DescribeSubnetsOutput](s.natsConn, "ec2.DescribeSubnets", input, 30*time.Second)
+func (s *NATSVPCService) DescribeSubnets(input *ec2.DescribeSubnetsInput, accountID string) (*ec2.DescribeSubnetsOutput, error) {
+	return utils.NATSRequest[ec2.DescribeSubnetsOutput](s.natsConn, "ec2.DescribeSubnets", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVPCService) CreateNetworkInterface(input *ec2.CreateNetworkInterfaceInput) (*ec2.CreateNetworkInterfaceOutput, error) {
-	return utils.NATSRequest[ec2.CreateNetworkInterfaceOutput](s.natsConn, "ec2.CreateNetworkInterface", input, 30*time.Second)
+func (s *NATSVPCService) CreateNetworkInterface(input *ec2.CreateNetworkInterfaceInput, accountID string) (*ec2.CreateNetworkInterfaceOutput, error) {
+	return utils.NATSRequest[ec2.CreateNetworkInterfaceOutput](s.natsConn, "ec2.CreateNetworkInterface", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVPCService) DeleteNetworkInterface(input *ec2.DeleteNetworkInterfaceInput) (*ec2.DeleteNetworkInterfaceOutput, error) {
-	return utils.NATSRequest[ec2.DeleteNetworkInterfaceOutput](s.natsConn, "ec2.DeleteNetworkInterface", input, 30*time.Second)
+func (s *NATSVPCService) DeleteNetworkInterface(input *ec2.DeleteNetworkInterfaceInput, accountID string) (*ec2.DeleteNetworkInterfaceOutput, error) {
+	return utils.NATSRequest[ec2.DeleteNetworkInterfaceOutput](s.natsConn, "ec2.DeleteNetworkInterface", input, 30*time.Second, accountID)
 }
 
-func (s *NATSVPCService) DescribeNetworkInterfaces(input *ec2.DescribeNetworkInterfacesInput) (*ec2.DescribeNetworkInterfacesOutput, error) {
-	return utils.NATSRequest[ec2.DescribeNetworkInterfacesOutput](s.natsConn, "ec2.DescribeNetworkInterfaces", input, 30*time.Second)
+func (s *NATSVPCService) DescribeNetworkInterfaces(input *ec2.DescribeNetworkInterfacesInput, accountID string) (*ec2.DescribeNetworkInterfacesOutput, error) {
+	return utils.NATSRequest[ec2.DescribeNetworkInterfacesOutput](s.natsConn, "ec2.DescribeNetworkInterfaces", input, 30*time.Second, accountID)
 }
diff --git a/hive/handlers/ec2/vpc/service_nats_test.go b/hive/handlers/ec2/vpc/service_nats_test.go
index f66003c7c..f8df6c8f1 100644
--- a/hive/handlers/ec2/vpc/service_nats_test.go
+++ b/hive/handlers/ec2/vpc/service_nats_test.go
@@ -44,14 +44,15 @@ func setupNATSVPCServiceTest(t *testing.T) (VPCService, *VPCServiceImpl, *nats.C
 }
 
 // handleNATSMsg is a generic NATS request handler that unmarshals the request,
-// calls the handler, and responds with the result.
-func handleNATSMsg[In any, Out any](msg *nats.Msg, fn func(*In) (*Out, error)) {
+// extracts the account ID from the header, calls the handler, and responds with the result.
+func handleNATSMsg[In any, Out any](msg *nats.Msg, fn func(*In, string) (*Out, error)) {
 	var input In
 	if err := json.Unmarshal(msg.Data, &input); err != nil {
 		_ = msg.Respond([]byte(`{"error":"unmarshal"}`))
 		return
 	}
-	result, err := fn(&input)
+	accountID := msg.Header.Get("X-Account-ID")
+	result, err := fn(&input, accountID)
 	if err != nil {
 		errResp, _ := json.Marshal(map[string]string{"error": err.Error()})
 		_ = msg.Respond(errResp)
@@ -66,7 +67,7 @@ func TestNATSVPCService_CreateVpc(t *testing.T) {
 
 	out, err := client.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, out.Vpc)
 	assert.NotEmpty(t, *out.Vpc.VpcId)
@@ -79,11 +80,11 @@ func TestNATSVPCService_DescribeVpcs(t *testing.T) {
 	// Create a VPC first
 	createOut, err := client.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	// Describe
-	out, err := client.DescribeVpcs(&ec2.DescribeVpcsInput{})
+	out, err := client.DescribeVpcs(&ec2.DescribeVpcsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.GreaterOrEqual(t, len(out.Vpcs), 1)
 
@@ -101,12 +102,12 @@ func TestNATSVPCService_DeleteVpc(t *testing.T) {
 
 	createOut, err := client.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = client.DeleteVpc(&ec2.DeleteVpcInput{
 		VpcId: createOut.Vpc.VpcId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 }
 
@@ -115,20 +116,20 @@ func TestNATSVPCService_CreateAndDeleteSubnet(t *testing.T) {
 
 	vpcOut, err := client.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	subnetOut, err := client.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     vpcOut.Vpc.VpcId,
 		CidrBlock: aws.String("10.0.1.0/24"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, subnetOut.Subnet)
 	assert.Equal(t, *vpcOut.Vpc.VpcId, *subnetOut.Subnet.VpcId)
 
 	_, err = client.DeleteSubnet(&ec2.DeleteSubnetInput{
 		SubnetId: subnetOut.Subnet.SubnetId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 }
 
@@ -137,16 +138,16 @@ func TestNATSVPCService_DescribeSubnets(t *testing.T) {
 
 	vpcOut, err := client.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = client.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     vpcOut.Vpc.VpcId,
 		CidrBlock: aws.String("10.0.1.0/24"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
-	out, err := client.DescribeSubnets(&ec2.DescribeSubnetsInput{})
+	out, err := client.DescribeSubnets(&ec2.DescribeSubnetsInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.GreaterOrEqual(t, len(out.Subnets), 1)
 }
@@ -156,24 +157,24 @@ func TestNATSVPCService_CreateAndDeleteENI(t *testing.T) {
 
 	vpcOut, err := client.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	subnetOut, err := client.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     vpcOut.Vpc.VpcId,
 		CidrBlock: aws.String("10.0.1.0/24"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	eniOut, err := client.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: subnetOut.Subnet.SubnetId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 	require.NotNil(t, eniOut.NetworkInterface)
 
 	_, err = client.DeleteNetworkInterface(&ec2.DeleteNetworkInterfaceInput{
 		NetworkInterfaceId: eniOut.NetworkInterface.NetworkInterfaceId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 }
 
@@ -182,21 +183,21 @@ func TestNATSVPCService_DescribeNetworkInterfaces(t *testing.T) {
 
 	vpcOut, err := client.CreateVpc(&ec2.CreateVpcInput{
 		CidrBlock: aws.String("10.0.0.0/16"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	subnetOut, err := client.CreateSubnet(&ec2.CreateSubnetInput{
 		VpcId:     vpcOut.Vpc.VpcId,
 		CidrBlock: aws.String("10.0.1.0/24"),
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
 	_, err = client.CreateNetworkInterface(&ec2.CreateNetworkInterfaceInput{
 		SubnetId: subnetOut.Subnet.SubnetId,
-	})
+	}, testAccountID)
 	require.NoError(t, err)
 
-	out, err := client.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{})
+	out, err := client.DescribeNetworkInterfaces(&ec2.DescribeNetworkInterfacesInput{}, testAccountID)
 	require.NoError(t, err)
 	assert.GreaterOrEqual(t, len(out.NetworkInterfaces), 1)
 }
diff --git a/hive/services/vpcd/integration_test.go b/hive/services/vpcd/integration_test.go
index 851b8c4f8..34cdf0824 100644
--- a/hive/services/vpcd/integration_test.go
+++ b/hive/services/vpcd/integration_test.go
@@ -13,6 +13,8 @@ import (
 	"github.com/nats-io/nats.go"
 )
 
+const testIGWAccountID = "123456789012"
+
 // startTestJetStreamNATS starts an embedded NATS server with JetStream for integration tests.
 func startTestJetStreamNATS(t *testing.T) (*server.Server, *nats.Conn) {
 	t.Helper()
@@ -165,7 +167,7 @@ func TestIntegration_VPCLifecycle(t *testing.T) {
 				},
 			},
 		},
-	})
+	}, testIGWAccountID)
 	if err != nil {
 		t.Fatalf("CreateInternetGateway: %v", err)
 	}
@@ -175,7 +177,7 @@ func TestIntegration_VPCLifecycle(t *testing.T) {
 	_, err = igwSvc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-integ1"),
-	})
+	}, testIGWAccountID)
 	if err != nil {
 		t.Fatalf("AttachInternetGateway: %v", err)
 	}
@@ -206,7 +208,7 @@ func TestIntegration_VPCLifecycle(t *testing.T) {
 	// Verify IGW state via Describe
 	descOut, err := igwSvc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{
 		InternetGatewayIds: []*string{aws.String(igwID)},
-	})
+	}, testIGWAccountID)
 	if err != nil {
 		t.Fatalf("DescribeInternetGateways: %v", err)
 	}
@@ -238,7 +240,7 @@ func TestIntegration_VPCLifecycle(t *testing.T) {
 	_, err = igwSvc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-integ1"),
-	})
+	}, testIGWAccountID)
 	if err != nil {
 		t.Fatalf("DetachInternetGateway: %v", err)
 	}
@@ -265,7 +267,7 @@ func TestIntegration_VPCLifecycle(t *testing.T) {
 	// === Phase 7: Delete IGW ===
 	_, err = igwSvc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
-	})
+	}, testIGWAccountID)
 	if err != nil {
 		t.Fatalf("DeleteInternetGateway: %v", err)
 	}
@@ -294,7 +296,7 @@ func TestIntegration_VPCLifecycle(t *testing.T) {
 		t.Errorf("expected 0 DHCP options after cleanup, got %d", len(dhcpList))
 	}
 
-	descOut, err = igwSvc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{})
+	descOut, err = igwSvc.DescribeInternetGateways(&ec2.DescribeInternetGatewaysInput{}, testIGWAccountID)
 	if err != nil {
 		t.Fatalf("DescribeInternetGateways: %v", err)
 	}
@@ -373,13 +375,13 @@ func TestIntegration_MultiSubnetWithIGW(t *testing.T) {
 
 	// Attach IGW
 	igwSvc, _ := handlers_ec2_igw.NewIGWServiceImplWithNATS(nil, nc)
-	igwOut, _ := igwSvc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{})
+	igwOut, _ := igwSvc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, testIGWAccountID)
 	igwID := *igwOut.InternetGateway.InternetGatewayId
 
 	_, err = igwSvc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-multi"),
-	})
+	}, testIGWAccountID)
 	if err != nil {
 		t.Fatalf("AttachInternetGateway: %v", err)
 	}
@@ -405,11 +407,11 @@ func TestIntegration_MultiSubnetWithIGW(t *testing.T) {
 	_, _ = igwSvc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-multi"),
-	})
+	}, testIGWAccountID)
 	time.Sleep(100 * time.Millisecond)
 	_, _ = igwSvc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
-	})
+	}, testIGWAccountID)
 
 	// Delete ports
 	for _, port := range ports {
@@ -463,18 +465,18 @@ func TestIntegration_IGWErrorPaths(t *testing.T) {
 	}
 
 	// Create and attach IGW
-	igwOut, _ := igwSvc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{})
+	igwOut, _ := igwSvc.CreateInternetGateway(&ec2.CreateInternetGatewayInput{}, testIGWAccountID)
 	igwID := *igwOut.InternetGateway.InternetGatewayId
 
 	// Can't delete while attached
 	_, _ = igwSvc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-err1"),
-	})
+	}, testIGWAccountID)
 
 	_, err = igwSvc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
-	})
+	}, testIGWAccountID)
 	if err == nil {
 		t.Error("expected DependencyViolation error")
 	}
@@ -483,7 +485,7 @@ func TestIntegration_IGWErrorPaths(t *testing.T) {
 	_, err = igwSvc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-err2"),
-	})
+	}, testIGWAccountID)
 	if err == nil {
 		t.Error("expected ResourceAlreadyAssociated error")
 	}
@@ -492,7 +494,7 @@ func TestIntegration_IGWErrorPaths(t *testing.T) {
 	_, err = igwSvc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-wrong"),
-	})
+	}, testIGWAccountID)
 	if err == nil {
 		t.Error("expected GatewayNotAttached error")
 	}
@@ -501,7 +503,7 @@ func TestIntegration_IGWErrorPaths(t *testing.T) {
 	_, err = igwSvc.AttachInternetGateway(&ec2.AttachInternetGatewayInput{
 		InternetGatewayId: aws.String("igw-doesnotexist"),
 		VpcId:             aws.String("vpc-err1"),
-	})
+	}, testIGWAccountID)
 	if err == nil {
 		t.Error("expected NotFound error for attach")
 	}
@@ -509,7 +511,7 @@ func TestIntegration_IGWErrorPaths(t *testing.T) {
 	_, err = igwSvc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String("igw-doesnotexist"),
 		VpcId:             aws.String("vpc-err1"),
-	})
+	}, testIGWAccountID)
 	if err == nil {
 		t.Error("expected NotFound error for detach")
 	}
@@ -518,8 +520,8 @@ func TestIntegration_IGWErrorPaths(t *testing.T) {
 	_, _ = igwSvc.DetachInternetGateway(&ec2.DetachInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
 		VpcId:             aws.String("vpc-err1"),
-	})
+	}, testIGWAccountID)
 	_, _ = igwSvc.DeleteInternetGateway(&ec2.DeleteInternetGatewayInput{
 		InternetGatewayId: aws.String(igwID),
-	})
+	}, testIGWAccountID)
 }
diff --git a/hive/utils/nats.go b/hive/utils/nats.go
index b098832cf..80684e386 100644
--- a/hive/utils/nats.go
+++ b/hive/utils/nats.go
@@ -37,16 +37,26 @@ func ConnectNATS(host, token string) (*nats.Conn, error) {
 	return nc, nil
 }
 
+// AccountIDHeader is the NATS message header key used to pass the caller's
+// AWS account ID from the gateway to daemon handlers.
+const AccountIDHeader = "X-Account-ID"
+
 // NATSRequest performs a NATS request-response with JSON marshaling.
-// It marshals the input, sends to the given subject, validates the response
-// for error payloads, and unmarshals the successful response into Out.
-func NATSRequest[Out any](conn *nats.Conn, subject string, input any, timeout time.Duration) (*Out, error) {
+// It marshals the input, sends to the given subject with the X-Account-ID
+// header, validates the response for error payloads, and unmarshals the
+// successful response into Out. Handlers can ignore the account ID if the
+// operation is unscoped (e.g. DescribeInstanceTypes).
+func NATSRequest[Out any](conn *nats.Conn, subject string, input any, timeout time.Duration, accountID string) (*Out, error) {
 	jsonData, err := json.Marshal(input)
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal input: %w", err)
 	}
 
-	msg, err := conn.Request(subject, jsonData, timeout)
+	reqMsg := nats.NewMsg(subject)
+	reqMsg.Data = jsonData
+	reqMsg.Header.Set(AccountIDHeader, accountID)
+
+	msg, err := conn.RequestMsg(reqMsg, timeout)
 	if err != nil {
 		if errors.Is(err, nats.ErrNoResponders) {
 			return nil, fmt.Errorf("NATS request to %s: %w", subject, nats.ErrNoResponders)
@@ -66,3 +76,12 @@ func NATSRequest[Out any](conn *nats.Conn, subject string, input any, timeout ti
 
 	return &output, nil
 }
+
+// AccountIDFromMsg extracts the caller's account ID from a NATS message header.
+// Returns the account ID, or empty string if the header is not set.
+func AccountIDFromMsg(msg *nats.Msg) string {
+	if msg == nil || msg.Header == nil {
+		return ""
+	}
+	return msg.Header.Get(AccountIDHeader)
+}
diff --git a/hive/utils/nats_test.go b/hive/utils/nats_test.go
index b284f618e..e772d06c3 100644
--- a/hive/utils/nats_test.go
+++ b/hive/utils/nats_test.go
@@ -113,7 +113,7 @@ func TestNATSRequest_Success(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	result, err := NATSRequest[Resp](nc, "test.greet", Req{Name: "world"}, 2*time.Second)
+	result, err := NATSRequest[Resp](nc, "test.greet", Req{Name: "world"}, 2*time.Second, "")
 	require.NoError(t, err)
 	assert.Equal(t, "hello world", result.Greeting)
 }
@@ -133,7 +133,7 @@ func TestNATSRequest_ErrorResponse(t *testing.T) {
 	require.NoError(t, err)
 
 	type Resp struct{}
-	_, err = NATSRequest[Resp](nc, "test.fail", struct{}{}, 2*time.Second)
+	_, err = NATSRequest[Resp](nc, "test.fail", struct{}{}, 2*time.Second, "")
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "InvalidParameterValue")
 }
@@ -146,7 +146,7 @@ func TestNATSRequest_NoResponders(t *testing.T) {
 	defer nc.Close()
 
 	type Resp struct{}
-	_, err = NATSRequest[Resp](nc, "test.nobody", struct{}{}, 500*time.Millisecond)
+	_, err = NATSRequest[Resp](nc, "test.nobody", struct{}{}, 500*time.Millisecond, "")
 	assert.Error(t, err)
 }
 
@@ -164,7 +164,7 @@ func TestNATSRequest_Timeout(t *testing.T) {
 	require.NoError(t, err)
 
 	type Resp struct{}
-	_, err = NATSRequest[Resp](nc, "test.slow", struct{}{}, 100*time.Millisecond)
+	_, err = NATSRequest[Resp](nc, "test.slow", struct{}{}, 100*time.Millisecond, "")
 	assert.Error(t, err)
 }
 
@@ -184,7 +184,78 @@ func TestNATSRequest_InvalidUnmarshal(t *testing.T) {
 	type Resp struct {
 		Value int `json:"value"`
 	}
-	_, err = NATSRequest[Resp](nc, "test.badjson", struct{}{}, 2*time.Second)
+	_, err = NATSRequest[Resp](nc, "test.badjson", struct{}{}, 2*time.Second, "")
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "unmarshal")
 }
+
+// --- NATSRequest with account ID tests ---
+
+func TestNATSRequest_AccountIDHeader(t *testing.T) {
+	ns := startTestNATSServer(t)
+
+	nc, err := nats.Connect(ns.ClientURL())
+	require.NoError(t, err)
+	defer nc.Close()
+
+	type Req struct {
+		Name string `json:"name"`
+	}
+	type Resp struct {
+		Greeting  string `json:"greeting"`
+		AccountID string `json:"account_id"`
+	}
+
+	// Responder echoes back the account ID from the header
+	_, err = nc.Subscribe("test.account", func(msg *nats.Msg) {
+		var req Req
+		json.Unmarshal(msg.Data, &req)
+		acct := AccountIDFromMsg(msg)
+		resp := Resp{Greeting: "hello " + req.Name, AccountID: acct}
+		data, _ := json.Marshal(resp)
+		msg.Respond(data)
+	})
+	require.NoError(t, err)
+
+	result, err := NATSRequest[Resp](nc, "test.account", Req{Name: "world"}, 2*time.Second, "111122223333")
+	require.NoError(t, err)
+	assert.Equal(t, "hello world", result.Greeting)
+	assert.Equal(t, "111122223333", result.AccountID)
+}
+
+func TestNATSRequest_MarshalError(t *testing.T) {
+	ns := startTestNATSServer(t)
+
+	nc, err := nats.Connect(ns.ClientURL())
+	require.NoError(t, err)
+	defer nc.Close()
+
+	type Resp struct{}
+	// Channels cannot be marshaled to JSON
+	_, err = NATSRequest[Resp](nc, "test.marshalfail", make(chan int), 2*time.Second, "")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to marshal input")
+}
+
+// --- AccountIDFromMsg tests ---
+
+func TestAccountIDFromMsg(t *testing.T) {
+	msg := nats.NewMsg("test")
+	msg.Header.Set(AccountIDHeader, "444455556666")
+
+	assert.Equal(t, "444455556666", AccountIDFromMsg(msg))
+}
+
+func TestAccountIDFromMsg_Missing(t *testing.T) {
+	msg := nats.NewMsg("test")
+	assert.Equal(t, "", AccountIDFromMsg(msg))
+}
+
+func TestAccountIDFromMsg_NilMsg(t *testing.T) {
+	assert.Equal(t, "", AccountIDFromMsg(nil))
+}
+
+func TestAccountIDFromMsg_NilHeader(t *testing.T) {
+	msg := &nats.Msg{Subject: "test"}
+	assert.Equal(t, "", AccountIDFromMsg(msg))
+}
diff --git a/hive/vm/vm.go b/hive/vm/vm.go
index 51a0b7380..ccff35959 100644
--- a/hive/vm/vm.go
+++ b/hive/vm/vm.go
@@ -60,6 +60,10 @@ type VM struct {
 	// Health tracks crash detection and auto-restart state
 	Health InstanceHealthState `json:"health"`
 
+	// AccountID is the AWS account that owns this instance.
+	// Empty for pre-Phase4 resources (treated as visible to all accounts).
+	AccountID string `json:"account_id,omitempty"`
+
 	// VPC networking: ENI attached to this instance (set by RunInstances when VPC mode is active)
 	ENIId  string `json:"eni_id,omitempty"`
 	ENIMac string `json:"eni_mac,omitempty"`
diff --git a/scripts/check-coverage.sh b/scripts/check-coverage.sh
new file mode 100755
index 000000000..cee01ca66
--- /dev/null
+++ b/scripts/check-coverage.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Check total coverage meets minimum threshold.
+# Usage: scripts/check-coverage.sh <coverprofile> <min_coverage> [quiet]
+
+PROFILE="${1:?Usage: check-coverage.sh <coverprofile> <min_coverage> [quiet]}"
+MIN="${2:-60.0}"
+QUIET="${3:-}"
+
+if [[ ! -s "$PROFILE" ]]; then
+    echo "ERROR: No coverage data generated — tests may have failed to compile"
+    exit 1
+fi
+
+TOTAL=$(go tool cover -func="$PROFILE" | tail -1 | awk '{print $NF}' | tr -d '%')
+
+if [[ -z "$TOTAL" ]]; then
+    echo "ERROR: No coverage data generated — tests may have failed to compile"
+    exit 1
+fi
+
+if [[ -z "$QUIET" ]]; then
+    echo ""
+    echo "=== Total Coverage ==="
+    go tool cover -func="$PROFILE" | tail -1
+fi
+
+PASS=$(echo "$TOTAL >= $MIN" | bc -l)
+if [[ "$PASS" != "1" ]]; then
+    echo "ERROR: Total coverage ${TOTAL}% is below minimum ${MIN}%"
+    exit 1
+fi
+
+[[ -z "$QUIET" ]] && echo "Coverage ${TOTAL}% meets minimum ${MIN}% threshold"
+exit 0
diff --git a/scripts/diff-coverage.sh b/scripts/diff-coverage.sh
index dca5c1b85..dd6ea2fc2 100755
--- a/scripts/diff-coverage.sh
+++ b/scripts/diff-coverage.sh
@@ -47,7 +47,7 @@ if [[ -z "$BASE_REF" ]]; then
         dev)  BASE_REF="origin/main" ;;
         *)    BASE_REF="origin/dev" ;;
     esac
-    echo "Base ref: $BASE_REF (branch: $BRANCH)"
+    [[ -z "$QUIET" ]] && echo "Base ref: $BASE_REF (branch: $BRANCH)"
 fi
 
 # Verify base ref exists
@@ -135,8 +135,6 @@ awk -v threshold="$THRESHOLD" '
             total++
             if (cov[$1]) {
                 covered++
-            } else {
-                uncov[uncov_n++] = $1
             }
         } else {
             skipped++
@@ -157,19 +155,16 @@ awk -v threshold="$THRESHOLD" '
         uncovered = total - covered
         pct = (covered / total) * 100
 
-        printf "\n=== Diff Coverage ===\n"
-        printf "Instrumentable lines:   %d\n", total
-        printf "Covered:                %d\n", covered+0
-        printf "Uncovered:              %d\n", uncovered
-        printf "Non-instrumentable:     %d (skipped)\n", skipped+0
-        printf "Diff coverage:          %.1f%%\n", pct
-        printf "Threshold:              %d%%\n", threshold
+        quiet = ENVIRON["QUIET"]
 
-        if (uncovered > 0) {
-            printf "\nUncovered lines:\n"
-            for (i = 0; i < uncov_n; i++) {
-                printf "  %s\n", uncov[i]
-            }
+        if (!quiet) {
+            printf "\n=== Diff Coverage ===\n"
+            printf "Instrumentable lines:   %d\n", total
+            printf "Covered:                %d\n", covered+0
+            printf "Uncovered:              %d\n", uncovered
+            printf "Non-instrumentable:     %d (skipped)\n", skipped+0
+            printf "Diff coverage:          %.1f%%\n", pct
+            printf "Threshold:              %d%%\n", threshold
         }
 
         if (pct + 0.05 < threshold) {
diff --git a/tests/e2e/TEST_COVERAGE.md b/tests/e2e/TEST_COVERAGE.md
index 5d059017e..f176e7817 100644
--- a/tests/e2e/TEST_COVERAGE.md
+++ b/tests/e2e/TEST_COVERAGE.md
@@ -205,6 +205,86 @@
 - Delete all test policies (`list-policies` count = 0)
 - Clean up AWS CLI profiles
 
+### Phase 8: EC2 Account Scoping
+
+Tests that EC2 resources are properly isolated between tenant accounts (Alpha, Beta). Based on `docs/development/feature/iam-phase4-e2e-test-guide.md`. Skips CreateImage (mulga-612) and instance tags (mulga-613).
+
+#### Step 1: Account Setup
+- `hive admin account create` (Team Alpha, Team Beta)
+- Configure AWS CLI profiles
+- Verify auth for both accounts
+
+#### Step 2: Instance Scoping
+- Alpha + Beta each launch 1 instance
+- `describe-instances` isolation (each sees only own)
+- OwnerId field matches account ID
+- Cross-account `stop-instances` → `InvalidInstanceID.NotFound`
+- Cross-account `terminate-instances` → `InvalidInstanceID.NotFound`
+- Cross-account `start-instances` → `InvalidInstanceID.NotFound`
+- Cross-account `modify-instance-attribute` → `InvalidInstanceID.NotFound`
+- Cross-account `get-console-output` → `InvalidInstanceID.NotFound`
+
+#### Step 3: Volume Scoping
+- Alpha + Beta each create 1 volume
+- `describe-volumes` isolation
+- Cross-account `describe-volumes` by ID → `InvalidVolume.NotFound`
+- Cross-account `delete-volume` → `InvalidVolume.NotFound`
+- Cross-account `attach-volume` → `InvalidVolume.NotFound`
+- Cross-account `detach-volume` → `InvalidVolume.NotFound`
+- Cross-account `modify-volume` → `InvalidVolume.NotFound`
+
+#### Step 4: Key Pair Scoping
+- Alpha + Beta each create key pair
+- `describe-key-pairs` isolation
+- Same key name in both accounts (namespace isolation — different KeyPairIds)
+- Cross-account `delete-key-pair` → no effect on other account's key
+- `import-key-pair` → invisible to other account
+
+#### Step 5: Snapshot Scoping
+- Alpha + Beta each create snapshot from own volume
+- `describe-snapshots` isolation + OwnerId verification
+- Cross-account `delete-snapshot` → `UnauthorizedOperation`
+- Cross-account `create-snapshot` from other's volume → `InvalidVolume.NotFound`
+
+#### Step 6: VPC/Subnet Scoping
+- Alpha + Beta each create VPC (same CIDR — no conflict)
+- `describe-vpcs` isolation
+- Cross-account `describe-vpcs` by ID → `InvalidVpcID.NotFound`
+- Cross-account `delete-vpc` → `InvalidVpcID.NotFound`
+- Alpha + Beta each create subnet
+- `describe-subnets` isolation
+- Cross-account `create-subnet` in other's VPC → `InvalidVpcID.NotFound`
+- Cross-account `delete-subnet` → `InvalidSubnetID.NotFound`
+
+#### Step 7: IGW + EIGW Scoping
+- Alpha + Beta each create IGW
+- `describe-internet-gateways` isolation
+- Cross-account `describe-internet-gateways` by ID → `InvalidInternetGatewayID.NotFound`
+- Cross-account `delete-internet-gateway` → `InvalidInternetGatewayID.NotFound`
+- Cross-account `attach-internet-gateway` → `InvalidInternetGatewayID.NotFound`
+- Cross-account `detach-internet-gateway` → `InvalidInternetGatewayID.NotFound`
+- Alpha + Beta each create EIGW
+- `describe-egress-only-internet-gateways` isolation
+- Cross-account EIGW delete → no effect
+
+#### Step 8: Account Settings
+- Alpha `enable-ebs-encryption-by-default` → Beta unaffected
+- Independent toggle verification
+
+#### Step 9: Global Resources
+- `describe-regions` identical for both accounts
+- `describe-availability-zones` identical
+- `describe-instance-types` identical
+
+#### Step 10: Edge Cases
+- Empty account (Gamma) — no resources visible
+- Root isolation from tenants (root cannot see tenant instances)
+- Non-existent resource IDs → same error as cross-account (no info leakage)
+
+#### Step 11: Cleanup
+- Terminate instances, delete volumes/snapshots/keys/VPCs/IGWs/EIGWs/subnets
+- Clean up AWS CLI profiles
+
 ### Phase 9: Terminate and Verify Cleanup
 - `delete-snapshot` (CreateImage backing snapshot, so DeleteOnTermination is not blocked)
 - `terminate-instances` (poll -> terminated)
@@ -366,8 +446,65 @@
 - Verify Alpha alice gone (`NoSuchEntity`)
 - Verify Beta alice unaffected (still exists, auth still works)
 
-#### Step 7: IAM Account Cleanup
-- Delete all account users, policies, access keys
+#### Step 7: EC2 Resource Scoping
+
+Tests that EC2 resources are properly isolated between the Alpha/Beta accounts. Skips CreateImage (mulga-612) and instance tags (mulga-613).
+
+**7a: Instance Scoping**
+- Alpha + Beta each launch 1 instance
+- `describe-instances` isolation (each sees only own)
+- OwnerId field matches account ID
+- Cross-account `stop-instances` → `InvalidInstanceID.NotFound`
+- Cross-account `terminate-instances` → `InvalidInstanceID.NotFound`
+- Cross-account `get-console-output` → `InvalidInstanceID.NotFound`
+
+**7b: Volume Scoping**
+- Alpha + Beta each create 1 volume
+- `describe-volumes` isolation
+- Cross-account `describe-volumes` by ID → `InvalidVolume.NotFound`
+- Cross-account `delete-volume` → `InvalidVolume.NotFound`
+- Cross-account `attach-volume` → `InvalidVolume.NotFound`
+- Cross-account `detach-volume` → `InvalidVolume.NotFound`
+- Cross-account `modify-volume` → `InvalidVolume.NotFound`
+
+**7c: Key Pair Scoping**
+- Alpha + Beta each create key pair
+- `describe-key-pairs` isolation
+- Same key name in both accounts (namespace isolation — different KeyPairIds)
+- Cross-account `delete-key-pair` → no effect on other account's key
+- `import-key-pair` → invisible to other account
+
+**7d: Snapshot Scoping**
+- Alpha + Beta each create snapshot from own volume
+- `describe-snapshots` isolation + OwnerId verification
+- Cross-account `delete-snapshot` → `UnauthorizedOperation`
+- Cross-account `create-snapshot` from other's volume → `InvalidVolume.NotFound`
+
+**7e: VPC/Subnet Scoping**
+- Alpha + Beta each create VPC (same CIDR — no conflict)
+- `describe-vpcs` / `describe-subnets` isolation
+- Cross-account VPC/subnet operations → `NotFound`
+
+**7f: IGW + EIGW Scoping**
+- Alpha + Beta each create IGW + EIGW
+- Describe isolation for both
+- Cross-account attach/detach/delete → `NotFound`
+
+**7g: Account Settings**
+- `enable-ebs-encryption-by-default` per account — independent toggle
+
+**7h: Global Resources**
+- `describe-regions`, `describe-availability-zones`, `describe-instance-types` identical for both accounts
+
+#### Step 8: Edge Cases
+- Empty account (Gamma) — no resources visible
+- Root isolation from tenants
+- Non-existent resource IDs → same error as cross-account
+- Parallel key creation (race condition) — no cross-contamination
+
+#### Step 9: EC2 + IAM Cleanup
+- Terminate instances, delete volumes/snapshots/keys/VPCs/IGWs/EIGWs/subnets
+- Delete all IAM users, policies, access keys
 - Clean up AWS CLI profiles
 
 ### Phase 5d: VPC Networking
diff --git a/tests/e2e/run-e2e.sh b/tests/e2e/run-e2e.sh
index 14add6ab6..952208eb6 100755
--- a/tests/e2e/run-e2e.sh
+++ b/tests/e2e/run-e2e.sh
@@ -1746,6 +1746,713 @@ echo "IAM Phase 7 passed"
 echo ""
 echo "IAM E2E Tests Completed Successfully"
 
+# =============================================================================
+# Phase 8: EC2 Account Scoping
+# =============================================================================
+# Tests that EC2 resources (instances, volumes, key pairs, snapshots, VPCs,
+# IGWs, EIGWs) are properly isolated between tenant accounts.
+# Based on: docs/development/feature/iam-phase4-e2e-test-guide.md
+# Skips: Section 6 (CreateImage — mulga-612), Tags on instances (mulga-613)
+echo ""
+echo "Phase 8: EC2 Account Scoping"
+echo "========================================"
+
+# --- Step 1: Account Setup ---
+echo ""
+echo "Phase 8 Step 1: Account Setup"
+echo "----------------------------------------"
+
+echo "  Creating Team Alpha account..."
+ALPHA_OUTPUT=$(./bin/hive admin account create --name "Team Alpha" 2>&1)
+echo "$ALPHA_OUTPUT"
+ALPHA_ACCOUNT=$(echo "$ALPHA_OUTPUT" | grep "Account ID:" | awk '{print $NF}')
+ALPHA_KEY_ID=$(echo "$ALPHA_OUTPUT" | grep "Access Key ID:" | awk '{print $NF}')
+ALPHA_SECRET=$(echo "$ALPHA_OUTPUT" | grep "Secret Access Key:" | awk '{print $NF}')
+
+if [ -z "$ALPHA_ACCOUNT" ] || [ -z "$ALPHA_KEY_ID" ]; then
+    echo "  ERROR: Failed to parse Team Alpha account output"
+    exit 1
+fi
+echo "  Team Alpha: account=$ALPHA_ACCOUNT key=$ALPHA_KEY_ID"
+setup_test_profile hive-team-alpha "$ALPHA_KEY_ID" "$ALPHA_SECRET"
+
+echo "  Creating Team Beta account..."
+BETA_OUTPUT=$(./bin/hive admin account create --name "Team Beta" 2>&1)
+echo "$BETA_OUTPUT"
+BETA_ACCOUNT=$(echo "$BETA_OUTPUT" | grep "Account ID:" | awk '{print $NF}')
+BETA_KEY_ID=$(echo "$BETA_OUTPUT" | grep "Access Key ID:" | awk '{print $NF}')
+BETA_SECRET=$(echo "$BETA_OUTPUT" | grep "Secret Access Key:" | awk '{print $NF}')
+
+if [ -z "$BETA_ACCOUNT" ] || [ -z "$BETA_KEY_ID" ]; then
+    echo "  ERROR: Failed to parse Team Beta account output"
+    exit 1
+fi
+echo "  Team Beta: account=$BETA_ACCOUNT key=$BETA_KEY_ID"
+setup_test_profile hive-team-beta "$BETA_KEY_ID" "$BETA_SECRET"
+
+# Verify auth
+aws ec2 describe-instances --profile hive-team-alpha > /dev/null
+echo "  Alpha auth OK"
+aws ec2 describe-instances --profile hive-team-beta > /dev/null
+echo "  Beta auth OK"
+
+echo "  Account setup complete"
+
+# --- Step 2: Instance Scoping ---
+echo ""
+echo "Phase 8 Step 2: Instance Scoping"
+echo "----------------------------------------"
+
+# Create per-account key pairs (key pairs are account-scoped, root's test-key-1 is invisible)
+aws ec2 create-key-pair --key-name alpha-instance-key --profile hive-team-alpha > /dev/null
+aws ec2 create-key-pair --key-name beta-instance-key --profile hive-team-beta > /dev/null
+echo "  Created per-account key pairs for instance launches"
+
+echo "  Alpha launching instance..."
+ALPHA_RUN=$(aws ec2 run-instances \
+    --image-id "$AMI_ID" \
+    --instance-type "$INSTANCE_TYPE" \
+    --key-name alpha-instance-key \
+    --profile hive-team-alpha)
+ALPHA_INST=$(echo "$ALPHA_RUN" | jq -r '.Instances[0].InstanceId')
+echo "  Alpha instance: $ALPHA_INST"
+
+echo "  Beta launching instance..."
+BETA_RUN=$(aws ec2 run-instances \
+    --image-id "$AMI_ID" \
+    --instance-type "$INSTANCE_TYPE" \
+    --key-name beta-instance-key \
+    --profile hive-team-beta)
+BETA_INST=$(echo "$BETA_RUN" | jq -r '.Instances[0].InstanceId')
+echo "  Beta instance: $BETA_INST"
+
+# Wait for running
+echo "  Waiting for instances to reach running state..."
+COUNT=0
+while [ $COUNT -lt 30 ]; do
+    A_STATE=$(aws ec2 describe-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null || echo "pending")
+    B_STATE=$(aws ec2 describe-instances --instance-ids "$BETA_INST" --profile hive-team-beta \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null || echo "pending")
+    echo "  Alpha=$A_STATE, Beta=$B_STATE"
+    if [ "$A_STATE" == "running" ] && [ "$B_STATE" == "running" ]; then break; fi
+    sleep 2
+    COUNT=$((COUNT + 1))
+done
+if [ "$A_STATE" != "running" ] || [ "$B_STATE" != "running" ]; then
+    echo "  ERROR: Instances failed to reach running state"
+    exit 1
+fi
+echo "  Both instances running"
+
+# Describe isolation
+ALPHA_INSTANCES=$(aws ec2 describe-instances --profile hive-team-alpha \
+    --query 'Reservations[].Instances[].InstanceId' --output text)
+if echo "$ALPHA_INSTANCES" | grep -q "$BETA_INST"; then
+    echo "  ERROR: Alpha can see Beta's instance"
+    exit 1
+fi
+echo "  Alpha sees only own instances"
+
+BETA_INSTANCES=$(aws ec2 describe-instances --profile hive-team-beta \
+    --query 'Reservations[].Instances[].InstanceId' --output text)
+if echo "$BETA_INSTANCES" | grep -q "$ALPHA_INST"; then
+    echo "  ERROR: Beta can see Alpha's instance"
+    exit 1
+fi
+echo "  Beta sees only own instances"
+
+# OwnerId verification
+ALPHA_OWNER=$(aws ec2 describe-instances --profile hive-team-alpha \
+    --query 'Reservations[0].OwnerId' --output text)
+if [ "$ALPHA_OWNER" != "$ALPHA_ACCOUNT" ]; then
+    echo "  ERROR: Alpha OwnerId mismatch: expected $ALPHA_ACCOUNT, got $ALPHA_OWNER"
+    exit 1
+fi
+echo "  Alpha OwnerId correct: $ALPHA_OWNER"
+
+# Cross-account operations
+expect_error "InvalidInstanceID.NotFound" \
+    aws ec2 stop-instances --instance-ids "$BETA_INST" --profile hive-team-alpha
+echo "  Alpha cannot stop Beta's instance"
+
+expect_error "InvalidInstanceID.NotFound" \
+    aws ec2 terminate-instances --instance-ids "$ALPHA_INST" --profile hive-team-beta
+echo "  Beta cannot terminate Alpha's instance"
+
+# Stop Alpha's instance for cross-account start/modify/console tests
+aws ec2 stop-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha > /dev/null
+COUNT=0
+while [ $COUNT -lt 30 ]; do
+    A_STATE=$(aws ec2 describe-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null)
+    if [ "$A_STATE" == "stopped" ]; then break; fi
+    sleep 2
+    COUNT=$((COUNT + 1))
+done
+
+expect_error "InvalidInstanceID.NotFound" \
+    aws ec2 start-instances --instance-ids "$ALPHA_INST" --profile hive-team-beta
+echo "  Beta cannot start Alpha's stopped instance"
+
+expect_error "InvalidInstanceID.NotFound" \
+    aws ec2 modify-instance-attribute --instance-id "$ALPHA_INST" \
+    --instance-type '{"Value":"t2.small"}' --profile hive-team-beta
+echo "  Beta cannot modify Alpha's instance"
+
+expect_error "InvalidInstanceID.NotFound" \
+    aws ec2 get-console-output --instance-id "$ALPHA_INST" --profile hive-team-beta
+echo "  Beta cannot get console output of Alpha's instance"
+
+# Restart Alpha's instance for later tests
+aws ec2 start-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha > /dev/null
+COUNT=0
+while [ $COUNT -lt 30 ]; do
+    A_STATE=$(aws ec2 describe-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null)
+    if [ "$A_STATE" == "running" ]; then break; fi
+    sleep 2
+    COUNT=$((COUNT + 1))
+done
+
+echo "  Instance scoping passed"
+
+# --- Step 3: Volume Scoping ---
+echo ""
+echo "Phase 8 Step 3: Volume Scoping"
+echo "----------------------------------------"
+
+ALPHA_VOL=$(aws ec2 create-volume --availability-zone "$AZ_NAME" --size 10 \
+    --volume-type gp3 --profile hive-team-alpha | jq -r '.VolumeId')
+echo "  Alpha volume: $ALPHA_VOL"
+
+BETA_VOL=$(aws ec2 create-volume --availability-zone "$AZ_NAME" --size 10 \
+    --volume-type gp3 --profile hive-team-beta | jq -r '.VolumeId')
+echo "  Beta volume: $BETA_VOL"
+
+# Describe isolation
+ALPHA_VOLS=$(aws ec2 describe-volumes --profile hive-team-alpha \
+    --query 'Volumes[].VolumeId' --output text)
+if echo "$ALPHA_VOLS" | grep -q "$BETA_VOL"; then
+    echo "  ERROR: Alpha can see Beta's volume"
+    exit 1
+fi
+echo "  Alpha sees only own volumes"
+
+# Cross-account filter
+expect_error "InvalidVolume.NotFound" \
+    aws ec2 describe-volumes --volume-ids "$BETA_VOL" --profile hive-team-alpha
+echo "  Alpha cannot describe Beta's volume by ID"
+
+# Cross-account delete
+expect_error "InvalidVolume.NotFound" \
+    aws ec2 delete-volume --volume-id "$ALPHA_VOL" --profile hive-team-beta
+echo "  Beta cannot delete Alpha's volume"
+
+# Cross-account attach (other's volume)
+expect_error "InvalidVolume.NotFound" \
+    aws ec2 attach-volume --volume-id "$ALPHA_VOL" \
+    --instance-id "$BETA_INST" --device /dev/sdf --profile hive-team-beta
+echo "  Beta cannot attach Alpha's volume"
+
+# Attach Alpha's volume to Alpha's instance, then test cross-account detach
+aws ec2 attach-volume --volume-id "$ALPHA_VOL" \
+    --instance-id "$ALPHA_INST" --device /dev/sdf --profile hive-team-alpha > /dev/null
+sleep 2
+
+expect_error "InvalidVolume.NotFound" \
+    aws ec2 detach-volume --volume-id "$ALPHA_VOL" --profile hive-team-beta
+echo "  Beta cannot detach Alpha's volume"
+
+# Cross-account modify
+expect_error "InvalidVolume.NotFound" \
+    aws ec2 modify-volume --volume-id "$ALPHA_VOL" --size 20 --profile hive-team-beta
+echo "  Beta cannot modify Alpha's volume"
+
+# Detach for cleanup later
+aws ec2 detach-volume --volume-id "$ALPHA_VOL" --profile hive-team-alpha > /dev/null
+sleep 2
+
+echo "  Volume scoping passed"
+
+# --- Step 4: Key Pair Scoping ---
+echo ""
+echo "Phase 8 Step 4: Key Pair Scoping"
+echo "----------------------------------------"
+
+aws ec2 create-key-pair --key-name alpha-key --profile hive-team-alpha > /dev/null
+ALPHA_KEYPAIR_ID=$(aws ec2 describe-key-pairs --key-names alpha-key \
+    --profile hive-team-alpha --query 'KeyPairs[0].KeyPairId' --output text)
+echo "  Alpha key: alpha-key ($ALPHA_KEYPAIR_ID)"
+
+aws ec2 create-key-pair --key-name beta-key --profile hive-team-beta > /dev/null
+echo "  Beta key: beta-key"
+
+# Describe isolation
+ALPHA_KEYS=$(aws ec2 describe-key-pairs --profile hive-team-alpha \
+    --query 'KeyPairs[].KeyName' --output text)
+if echo "$ALPHA_KEYS" | grep -q "beta-key"; then
+    echo "  ERROR: Alpha can see Beta's key"
+    exit 1
+fi
+echo "  Alpha sees only own keys"
+
+# Same name in both accounts (namespace isolation)
+aws ec2 create-key-pair --key-name shared-name --profile hive-team-alpha > /dev/null
+aws ec2 create-key-pair --key-name shared-name --profile hive-team-beta > /dev/null
+ALPHA_SHARED_ID=$(aws ec2 describe-key-pairs --key-names shared-name \
+    --profile hive-team-alpha --query 'KeyPairs[0].KeyPairId' --output text)
+BETA_SHARED_ID=$(aws ec2 describe-key-pairs --key-names shared-name \
+    --profile hive-team-beta --query 'KeyPairs[0].KeyPairId' --output text)
+if [ "$ALPHA_SHARED_ID" == "$BETA_SHARED_ID" ]; then
+    echo "  ERROR: Same KeyPairId for shared-name in both accounts"
+    exit 1
+fi
+echo "  Namespace isolation: alpha=$ALPHA_SHARED_ID, beta=$BETA_SHARED_ID"
+
+# Cross-account delete (idempotent, but shouldn't affect other account)
+aws ec2 delete-key-pair --key-name alpha-key --profile hive-team-beta
+ALPHA_KEY_CHECK=$(aws ec2 describe-key-pairs --key-names alpha-key \
+    --profile hive-team-alpha --query 'KeyPairs[0].KeyPairId' --output text)
+if [ "$ALPHA_KEY_CHECK" != "$ALPHA_KEYPAIR_ID" ]; then
+    echo "  ERROR: Beta's delete affected Alpha's key"
+    exit 1
+fi
+echo "  Cross-account delete had no effect on Alpha's key"
+
+# Import key pair — account scoped
+ssh-keygen -t ed25519 -f /tmp/test-import-key -N "" -q
+aws ec2 import-key-pair --key-name imported-key \
+    --public-key-material fileb:///tmp/test-import-key.pub --profile hive-team-alpha > /dev/null
+BETA_IMPORT_CHECK=$(aws ec2 describe-key-pairs --profile hive-team-beta \
+    --query 'KeyPairs[].KeyName' --output text)
+if echo "$BETA_IMPORT_CHECK" | grep -q "imported-key"; then
+    echo "  ERROR: Beta can see Alpha's imported key"
+    exit 1
+fi
+echo "  Imported key invisible to Beta"
+rm -f /tmp/test-import-key /tmp/test-import-key.pub
+
+echo "  Key pair scoping passed"
+
+# --- Step 5: Snapshot Scoping ---
+echo ""
+echo "Phase 8 Step 5: Snapshot Scoping"
+echo "----------------------------------------"
+
+ALPHA_SNAP=$(aws ec2 create-snapshot --volume-id "$ALPHA_VOL" \
+    --description "Alpha snapshot" --profile hive-team-alpha | jq -r '.SnapshotId')
+echo "  Alpha snapshot: $ALPHA_SNAP"
+
+BETA_SNAP=$(aws ec2 create-snapshot --volume-id "$BETA_VOL" \
+    --description "Beta snapshot" --profile hive-team-beta | jq -r '.SnapshotId')
+echo "  Beta snapshot: $BETA_SNAP"
+
+# Describe isolation
+ALPHA_SNAPS=$(aws ec2 describe-snapshots --owner-ids self --profile hive-team-alpha \
+    --query 'Snapshots[].SnapshotId' --output text)
+if echo "$ALPHA_SNAPS" | grep -q "$BETA_SNAP"; then
+    echo "  ERROR: Alpha can see Beta's snapshot"
+    exit 1
+fi
+echo "  Alpha sees only own snapshots"
+
+# OwnerId verification
+ALPHA_SNAP_OWNER=$(aws ec2 describe-snapshots --owner-ids self --profile hive-team-alpha \
+    --query 'Snapshots[0].OwnerId' --output text)
+if [ "$ALPHA_SNAP_OWNER" != "$ALPHA_ACCOUNT" ]; then
+    echo "  ERROR: Snapshot OwnerId mismatch: expected $ALPHA_ACCOUNT, got $ALPHA_SNAP_OWNER"
+    exit 1
+fi
+echo "  Alpha snapshot OwnerId correct"
+
+# Cross-account delete
+expect_error "UnauthorizedOperation" \
+    aws ec2 delete-snapshot --snapshot-id "$ALPHA_SNAP" --profile hive-team-beta
+echo "  Beta cannot delete Alpha's snapshot"
+
+# Cross-account snapshot from other's volume
+expect_error "InvalidVolume.NotFound" \
+    aws ec2 create-snapshot --volume-id "$ALPHA_VOL" \
+    --description "stolen" --profile hive-team-beta
+echo "  Beta cannot snapshot Alpha's volume"
+
+echo "  Snapshot scoping passed"
+
+# --- Step 6: VPC/Subnet Scoping ---
+echo ""
+echo "Phase 8 Step 6: VPC/Subnet Scoping"
+echo "----------------------------------------"
+
+ALPHA_VPC=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
+    --profile hive-team-alpha --query 'Vpc.VpcId' --output text)
+echo "  Alpha VPC: $ALPHA_VPC"
+
+BETA_VPC=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
+    --profile hive-team-beta --query 'Vpc.VpcId' --output text)
+echo "  Beta VPC: $BETA_VPC (same CIDR — no conflict)"
+
+# Describe isolation
+ALPHA_VPCS=$(aws ec2 describe-vpcs --profile hive-team-alpha \
+    --query 'Vpcs[].VpcId' --output text)
+if echo "$ALPHA_VPCS" | grep -q "$BETA_VPC"; then
+    echo "  ERROR: Alpha can see Beta's VPC"
+    exit 1
+fi
+echo "  VPC describe isolation OK"
+
+# Cross-account describe by ID
+expect_error "InvalidVpcID.NotFound" \
+    aws ec2 describe-vpcs --vpc-ids "$BETA_VPC" --profile hive-team-alpha
+echo "  Alpha cannot describe Beta's VPC by ID"
+
+# Cross-account delete
+expect_error "InvalidVpcID.NotFound" \
+    aws ec2 delete-vpc --vpc-id "$ALPHA_VPC" --profile hive-team-beta
+echo "  Beta cannot delete Alpha's VPC"
+
+# Create subnets
+ALPHA_SUBNET=$(aws ec2 create-subnet --vpc-id "$ALPHA_VPC" --cidr-block 10.0.1.0/24 \
+    --profile hive-team-alpha --query 'Subnet.SubnetId' --output text)
+echo "  Alpha subnet: $ALPHA_SUBNET"
+
+BETA_SUBNET=$(aws ec2 create-subnet --vpc-id "$BETA_VPC" --cidr-block 10.0.1.0/24 \
+    --profile hive-team-beta --query 'Subnet.SubnetId' --output text)
+echo "  Beta subnet: $BETA_SUBNET"
+
+# Subnet describe isolation
+ALPHA_SUBNETS=$(aws ec2 describe-subnets --profile hive-team-alpha \
+    --query 'Subnets[].SubnetId' --output text)
+if echo "$ALPHA_SUBNETS" | grep -q "$BETA_SUBNET"; then
+    echo "  ERROR: Alpha can see Beta's subnet"
+    exit 1
+fi
+echo "  Subnet describe isolation OK"
+
+# Cross-account create subnet in other's VPC
+expect_error "InvalidVpcID.NotFound" \
+    aws ec2 create-subnet --vpc-id "$ALPHA_VPC" --cidr-block 10.0.2.0/24 \
+    --profile hive-team-beta
+echo "  Beta cannot create subnet in Alpha's VPC"
+
+# Cross-account subnet delete
+expect_error "InvalidSubnetID.NotFound" \
+    aws ec2 delete-subnet --subnet-id "$ALPHA_SUBNET" --profile hive-team-beta
+echo "  Beta cannot delete Alpha's subnet"
+
+echo "  VPC/Subnet scoping passed"
+
+# --- Step 7: IGW + EIGW Scoping ---
+echo ""
+echo "Phase 8 Step 7: IGW + EIGW Scoping"
+echo "----------------------------------------"
+
+# IGW
+ALPHA_IGW=$(aws ec2 create-internet-gateway --profile hive-team-alpha \
+    --query 'InternetGateway.InternetGatewayId' --output text)
+echo "  Alpha IGW: $ALPHA_IGW"
+
+BETA_IGW=$(aws ec2 create-internet-gateway --profile hive-team-beta \
+    --query 'InternetGateway.InternetGatewayId' --output text)
+echo "  Beta IGW: $BETA_IGW"
+
+# IGW describe isolation
+ALPHA_IGWS=$(aws ec2 describe-internet-gateways --profile hive-team-alpha \
+    --query 'InternetGateways[].InternetGatewayId' --output text)
+if echo "$ALPHA_IGWS" | grep -q "$BETA_IGW"; then
+    echo "  ERROR: Alpha can see Beta's IGW"
+    exit 1
+fi
+echo "  IGW describe isolation OK"
+
+# Cross-account IGW describe by ID
+expect_error "InvalidInternetGatewayID.NotFound" \
+    aws ec2 describe-internet-gateways --internet-gateway-ids "$BETA_IGW" \
+    --profile hive-team-alpha
+echo "  Alpha cannot describe Beta's IGW by ID"
+
+# Cross-account IGW delete
+expect_error "InvalidInternetGatewayID.NotFound" \
+    aws ec2 delete-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --profile hive-team-beta
+echo "  Beta cannot delete Alpha's IGW"
+
+# Cross-account attach IGW to other's VPC
+expect_error "InvalidInternetGatewayID.NotFound" \
+    aws ec2 attach-internet-gateway --internet-gateway-id "$BETA_IGW" \
+    --vpc-id "$ALPHA_VPC" --profile hive-team-alpha
+echo "  Alpha cannot attach Beta's IGW to own VPC"
+
+# Attach Alpha's IGW, test cross-account detach
+aws ec2 attach-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --vpc-id "$ALPHA_VPC" --profile hive-team-alpha > /dev/null
+expect_error "InvalidInternetGatewayID.NotFound" \
+    aws ec2 detach-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --vpc-id "$ALPHA_VPC" --profile hive-team-beta
+echo "  Beta cannot detach Alpha's IGW"
+
+# EIGW
+ALPHA_EIGW=$(aws ec2 create-egress-only-internet-gateway --vpc-id "$ALPHA_VPC" \
+    --profile hive-team-alpha \
+    --query 'EgressOnlyInternetGateway.EgressOnlyInternetGatewayId' --output text)
+echo "  Alpha EIGW: $ALPHA_EIGW"
+
+BETA_EIGW=$(aws ec2 create-egress-only-internet-gateway --vpc-id "$BETA_VPC" \
+    --profile hive-team-beta \
+    --query 'EgressOnlyInternetGateway.EgressOnlyInternetGatewayId' --output text)
+echo "  Beta EIGW: $BETA_EIGW"
+
+# EIGW describe isolation
+ALPHA_EIGWS=$(aws ec2 describe-egress-only-internet-gateways --profile hive-team-alpha \
+    --query 'EgressOnlyInternetGateways[].EgressOnlyInternetGatewayId' --output text)
+if echo "$ALPHA_EIGWS" | grep -q "$BETA_EIGW"; then
+    echo "  ERROR: Alpha can see Beta's EIGW"
+    exit 1
+fi
+echo "  EIGW describe isolation OK"
+
+# Cross-account EIGW delete
+expect_error "" \
+    aws ec2 delete-egress-only-internet-gateway \
+    --egress-only-internet-gateway-id "$ALPHA_EIGW" --profile hive-team-beta 2>&1 || true
+# Verify Alpha's EIGW still exists
+ALPHA_EIGW_CHECK=$(aws ec2 describe-egress-only-internet-gateways --profile hive-team-alpha \
+    --query 'EgressOnlyInternetGateways[].EgressOnlyInternetGatewayId' --output text)
+if ! echo "$ALPHA_EIGW_CHECK" | grep -q "$ALPHA_EIGW"; then
+    echo "  ERROR: Alpha's EIGW was deleted by Beta"
+    exit 1
+fi
+echo "  Beta cannot delete Alpha's EIGW"
+
+# Cross-account EIGW creation in other's VPC
+expect_error "" \
+    aws ec2 create-egress-only-internet-gateway --vpc-id "$ALPHA_VPC" \
+    --profile hive-team-beta 2>&1 || true
+echo "  Beta cannot create EIGW in Alpha's VPC"
+
+echo "  IGW + EIGW scoping passed"
+
+# --- Step 8: Account Settings ---
+echo ""
+echo "Phase 8 Step 8: Account Settings"
+echo "----------------------------------------"
+
+aws ec2 enable-ebs-encryption-by-default --profile hive-team-alpha > /dev/null
+BETA_ENC=$(aws ec2 get-ebs-encryption-by-default --profile hive-team-beta \
+    --query 'EbsEncryptionByDefault' --output text)
+if [ "$BETA_ENC" != "False" ]; then
+    echo "  ERROR: Alpha's encryption setting leaked to Beta (got $BETA_ENC)"
+    exit 1
+fi
+echo "  Alpha enable did not affect Beta"
+
+# Independent toggle
+aws ec2 enable-ebs-encryption-by-default --profile hive-team-beta > /dev/null
+aws ec2 disable-ebs-encryption-by-default --profile hive-team-alpha > /dev/null
+ALPHA_ENC=$(aws ec2 get-ebs-encryption-by-default --profile hive-team-alpha \
+    --query 'EbsEncryptionByDefault' --output text)
+BETA_ENC=$(aws ec2 get-ebs-encryption-by-default --profile hive-team-beta \
+    --query 'EbsEncryptionByDefault' --output text)
+if [ "$ALPHA_ENC" != "False" ] || [ "$BETA_ENC" != "True" ]; then
+    echo "  ERROR: Independent settings failed: alpha=$ALPHA_ENC beta=$BETA_ENC"
+    exit 1
+fi
+echo "  Independent toggle verified: alpha=$ALPHA_ENC, beta=$BETA_ENC"
+
+# Reset
+aws ec2 disable-ebs-encryption-by-default --profile hive-team-beta > /dev/null
+
+echo "  Account settings scoping passed"
+
+# --- Step 9: Global Resources ---
+echo ""
+echo "Phase 8 Step 9: Global Resources"
+echo "----------------------------------------"
+
+ALPHA_REGIONS=$(aws ec2 describe-regions --profile hive-team-alpha \
+    --query 'Regions[].RegionName' --output text)
+BETA_REGIONS=$(aws ec2 describe-regions --profile hive-team-beta \
+    --query 'Regions[].RegionName' --output text)
+if [ "$ALPHA_REGIONS" != "$BETA_REGIONS" ]; then
+    echo "  ERROR: Regions differ between accounts"
+    exit 1
+fi
+echo "  Regions identical"
+
+ALPHA_AZS=$(aws ec2 describe-availability-zones --profile hive-team-alpha \
+    --query 'AvailabilityZones[].ZoneName' --output text)
+BETA_AZS=$(aws ec2 describe-availability-zones --profile hive-team-beta \
+    --query 'AvailabilityZones[].ZoneName' --output text)
+if [ "$ALPHA_AZS" != "$BETA_AZS" ]; then
+    echo "  ERROR: AZs differ between accounts"
+    exit 1
+fi
+echo "  Availability zones identical"
+
+ALPHA_TYPES=$(aws ec2 describe-instance-types --profile hive-team-alpha \
+    --query 'InstanceTypes[].InstanceType' --output text | tr '\t' '\n' | sort)
+BETA_TYPES=$(aws ec2 describe-instance-types --profile hive-team-beta \
+    --query 'InstanceTypes[].InstanceType' --output text | tr '\t' '\n' | sort)
+if [ "$ALPHA_TYPES" != "$BETA_TYPES" ]; then
+    echo "  ERROR: Instance types differ between accounts"
+    exit 1
+fi
+echo "  Instance types identical"
+
+echo "  Global resources passed"
+
+# --- Step 10: Edge Cases ---
+echo ""
+echo "Phase 8 Step 10: Edge Cases"
+echo "----------------------------------------"
+
+# Empty account (Gamma)
+echo "  Creating empty Gamma account..."
+GAMMA_OUTPUT=$(./bin/hive admin account create --name "Team Gamma" 2>&1)
+GAMMA_KEY_ID=$(echo "$GAMMA_OUTPUT" | grep "Access Key ID:" | awk '{print $NF}')
+GAMMA_SECRET=$(echo "$GAMMA_OUTPUT" | grep "Secret Access Key:" | awk '{print $NF}')
+setup_test_profile hive-team-gamma "$GAMMA_KEY_ID" "$GAMMA_SECRET"
+
+GAMMA_INSTANCES=$(aws ec2 describe-instances --profile hive-team-gamma \
+    --query 'Reservations' --output text)
+if [ -n "$GAMMA_INSTANCES" ] && [ "$GAMMA_INSTANCES" != "None" ]; then
+    echo "  ERROR: Gamma has instances"
+    exit 1
+fi
+echo "  Gamma: no instances"
+
+# Skip volume check: root-account volumes (empty TenantID) are visible to all accounts by design
+echo "  Gamma: volumes skipped (root legacy volumes visible to all)"
+
+GAMMA_KEYS=$(aws ec2 describe-key-pairs --profile hive-team-gamma \
+    --query 'KeyPairs' --output text)
+if [ -n "$GAMMA_KEYS" ] && [ "$GAMMA_KEYS" != "None" ]; then
+    echo "  ERROR: Gamma has key pairs"
+    exit 1
+fi
+echo "  Gamma: no key pairs"
+
+GAMMA_SNAPS=$(aws ec2 describe-snapshots --owner-ids self --profile hive-team-gamma \
+    --query 'Snapshots' --output text)
+if [ -n "$GAMMA_SNAPS" ] && [ "$GAMMA_SNAPS" != "None" ]; then
+    echo "  ERROR: Gamma has snapshots"
+    exit 1
+fi
+echo "  Gamma: no snapshots"
+
+# Root isolation from tenants
+echo "  Verifying root isolation from tenants..."
+aws ec2 create-key-pair --key-name root-scoping-key > /dev/null
+ALPHA_ROOT_CHECK=$(aws ec2 describe-key-pairs --profile hive-team-alpha \
+    --query 'KeyPairs[].KeyName' --output text)
+if echo "$ALPHA_ROOT_CHECK" | grep -q "root-scoping-key"; then
+    echo "  ERROR: Alpha can see root's key pair"
+    exit 1
+fi
+echo "  Tenants cannot see root's key pairs"
+
+ROOT_INSTANCE_CHECK=$(aws ec2 describe-instances \
+    --query 'Reservations[].Instances[].InstanceId' --output text)
+if echo "$ROOT_INSTANCE_CHECK" | grep -q "$ALPHA_INST"; then
+    echo "  ERROR: Root can see Alpha's instance"
+    exit 1
+fi
+echo "  Root cannot see tenant instances"
+aws ec2 delete-key-pair --key-name root-scoping-key > /dev/null
+
+# Non-existent resource IDs — same error as cross-account
+expect_error "InvalidVolume.NotFound" \
+    aws ec2 delete-volume --volume-id vol-00000000000000000 --profile hive-team-alpha
+echo "  Non-existent volume: same error as cross-account"
+
+expect_error "InvalidSnapshot.NotFound" \
+    aws ec2 delete-snapshot --snapshot-id snap-00000000000000000 --profile hive-team-alpha
+echo "  Non-existent snapshot: same error as cross-account"
+
+echo "  Edge cases passed"
+
+# --- Step 11: EC2 Account Scoping Cleanup ---
+echo ""
+echo "Phase 8 Step 11: EC2 Account Scoping Cleanup"
+echo "----------------------------------------"
+
+# Terminate instances
+echo "  Terminating Alpha instance..."
+aws ec2 terminate-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha > /dev/null
+echo "  Terminating Beta instance..."
+aws ec2 terminate-instances --instance-ids "$BETA_INST" --profile hive-team-beta > /dev/null
+
+# Wait for termination
+COUNT=0
+while [ $COUNT -lt 30 ]; do
+    A_STATE=$(aws ec2 describe-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null || echo "terminated")
+    B_STATE=$(aws ec2 describe-instances --instance-ids "$BETA_INST" --profile hive-team-beta \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null || echo "terminated")
+    if [ "$A_STATE" == "terminated" ] && [ "$B_STATE" == "terminated" ]; then
+        break
+    fi
+    sleep 2
+    COUNT=$((COUNT + 1))
+done
+echo "  Instances terminated"
+
+# Delete snapshots
+echo "  Deleting snapshots..."
+aws ec2 delete-snapshot --snapshot-id "$ALPHA_SNAP" --profile hive-team-alpha 2>/dev/null || true
+aws ec2 delete-snapshot --snapshot-id "$BETA_SNAP" --profile hive-team-beta 2>/dev/null || true
+
+# Delete volumes (wait for detach/termination cleanup)
+sleep 3
+echo "  Deleting volumes..."
+aws ec2 delete-volume --volume-id "$ALPHA_VOL" --profile hive-team-alpha 2>/dev/null || true
+aws ec2 delete-volume --volume-id "$BETA_VOL" --profile hive-team-beta 2>/dev/null || true
+
+# Delete key pairs
+echo "  Deleting key pairs..."
+for key in alpha-key alpha-instance-key shared-name imported-key; do
+    aws ec2 delete-key-pair --key-name "$key" --profile hive-team-alpha 2>/dev/null || true
+done
+for key in beta-key beta-instance-key shared-name; do
+    aws ec2 delete-key-pair --key-name "$key" --profile hive-team-beta 2>/dev/null || true
+done
+
+# Delete EIGWs
+echo "  Deleting EIGWs..."
+aws ec2 delete-egress-only-internet-gateway \
+    --egress-only-internet-gateway-id "$ALPHA_EIGW" --profile hive-team-alpha 2>/dev/null || true
+aws ec2 delete-egress-only-internet-gateway \
+    --egress-only-internet-gateway-id "$BETA_EIGW" --profile hive-team-beta 2>/dev/null || true
+
+# Detach + delete IGWs
+echo "  Deleting IGWs..."
+aws ec2 detach-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --vpc-id "$ALPHA_VPC" --profile hive-team-alpha 2>/dev/null || true
+aws ec2 delete-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --profile hive-team-alpha 2>/dev/null || true
+aws ec2 delete-internet-gateway --internet-gateway-id "$BETA_IGW" \
+    --profile hive-team-beta 2>/dev/null || true
+
+# Delete subnets
+echo "  Deleting subnets..."
+aws ec2 delete-subnet --subnet-id "$ALPHA_SUBNET" --profile hive-team-alpha 2>/dev/null || true
+aws ec2 delete-subnet --subnet-id "$BETA_SUBNET" --profile hive-team-beta 2>/dev/null || true
+
+# Delete VPCs
+echo "  Deleting VPCs..."
+aws ec2 delete-vpc --vpc-id "$ALPHA_VPC" --profile hive-team-alpha 2>/dev/null || true
+aws ec2 delete-vpc --vpc-id "$BETA_VPC" --profile hive-team-beta 2>/dev/null || true
+
+# Clean up AWS CLI profiles
+for p in hive-team-alpha hive-team-beta hive-team-gamma; do
+    aws configure set aws_access_key_id "" --profile $p 2>/dev/null || true
+    aws configure set aws_secret_access_key "" --profile $p 2>/dev/null || true
+done
+
+echo "  EC2 account scoping cleanup complete"
+echo ""
+echo "Phase 8: EC2 Account Scoping PASSED"
+
 # Phase 9: Terminate and Verify Cleanup
 echo "Phase 9: Terminate and Verify Cleanup"
 
diff --git a/tests/e2e/run-multinode-e2e.sh b/tests/e2e/run-multinode-e2e.sh
index 3424b3669..fc65cd39d 100755
--- a/tests/e2e/run-multinode-e2e.sh
+++ b/tests/e2e/run-multinode-e2e.sh
@@ -1403,13 +1403,624 @@ echo "  Beta alice still exists (isolation OK)"
 aws $AWS_EP ec2 describe-instances --profile hive-beta-alice > /dev/null
 echo "  Beta alice auth still works (isolation OK)"
 
-# Step 7: IAM Account Cleanup
+# ==========================================================================
+# Step 7: EC2 Resource Scoping
+# ==========================================================================
+# Tests that EC2 resources are properly isolated between accounts.
+# Reuses Alpha/Beta accounts created in Step 1.
+# Skips: Section 6 (CreateImage — mulga-612), instance tags (mulga-613)
 echo ""
-echo "Step 7: IAM Account Cleanup"
+echo "Step 7: EC2 Resource Scoping"
+echo "========================================"
+
+# --- 7a: Instance Scoping ---
+echo ""
+echo "Step 7a: Instance Scoping"
 echo "----------------------------------------"
 
+# Create per-account key pairs (key pairs are account-scoped, root's multinode-test-key is invisible)
+$AWS_EC2 create-key-pair --key-name alpha-instance-key --profile hive-team-alpha > /dev/null
+$AWS_EC2 create-key-pair --key-name beta-instance-key --profile hive-team-beta > /dev/null
+echo "  Created per-account key pairs for instance launches"
+
+echo "  Alpha launching instance..."
+ALPHA_INST_RUN=$($AWS_EC2 run-instances \
+    --image-id "$AMI_ID" \
+    --instance-type "$INSTANCE_TYPE" \
+    --key-name alpha-instance-key \
+    --profile hive-team-alpha)
+ALPHA_INST=$(echo "$ALPHA_INST_RUN" | jq -r '.Instances[0].InstanceId')
+echo "  Alpha instance: $ALPHA_INST"
+
+echo "  Beta launching instance..."
+BETA_INST_RUN=$($AWS_EC2 run-instances \
+    --image-id "$AMI_ID" \
+    --instance-type "$INSTANCE_TYPE" \
+    --key-name beta-instance-key \
+    --profile hive-team-beta)
+BETA_INST=$(echo "$BETA_INST_RUN" | jq -r '.Instances[0].InstanceId')
+echo "  Beta instance: $BETA_INST"
+
+# Wait for running (inline — wait_for_instance_state uses root profile, can't see tenant instances)
+echo "  Waiting for instances to reach running state..."
+COUNT=0
+while [ $COUNT -lt 30 ]; do
+    A_STATE=$($AWS_EC2 describe-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null || echo "pending")
+    B_STATE=$($AWS_EC2 describe-instances --instance-ids "$BETA_INST" --profile hive-team-beta \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null || echo "pending")
+    echo "  Alpha=$A_STATE, Beta=$B_STATE"
+    if [ "$A_STATE" == "running" ] && [ "$B_STATE" == "running" ]; then break; fi
+    sleep 2
+    COUNT=$((COUNT + 1))
+done
+if [ "$A_STATE" != "running" ] || [ "$B_STATE" != "running" ]; then
+    echo "  ERROR: Instances failed to reach running state"
+    exit 1
+fi
+echo "  Both instances running"
+
+# Describe isolation
+ALPHA_DESC=$($AWS_EC2 describe-instances --profile hive-team-alpha \
+    --query 'Reservations[].Instances[].InstanceId' --output text)
+if echo "$ALPHA_DESC" | grep -q "$BETA_INST"; then
+    echo "  ERROR: Alpha can see Beta's instance"
+    exit 1
+fi
+echo "  Alpha sees only own instances"
+
+BETA_DESC=$($AWS_EC2 describe-instances --profile hive-team-beta \
+    --query 'Reservations[].Instances[].InstanceId' --output text)
+if echo "$BETA_DESC" | grep -q "$ALPHA_INST"; then
+    echo "  ERROR: Beta can see Alpha's instance"
+    exit 1
+fi
+echo "  Beta sees only own instances"
+
+# OwnerId verification
+ALPHA_OWNER=$($AWS_EC2 describe-instances --profile hive-team-alpha \
+    --query 'Reservations[0].OwnerId' --output text)
+if [ "$ALPHA_OWNER" != "$ALPHA_ACCOUNT" ]; then
+    echo "  ERROR: Alpha OwnerId mismatch: expected $ALPHA_ACCOUNT, got $ALPHA_OWNER"
+    exit 1
+fi
+echo "  Alpha OwnerId correct: $ALPHA_OWNER"
+
+# Cross-account operations
+expect_error "InvalidInstanceID.NotFound" \
+    $AWS_EC2 stop-instances --instance-ids "$BETA_INST" --profile hive-team-alpha
+echo "  Alpha cannot stop Beta's instance"
+
+expect_error "InvalidInstanceID.NotFound" \
+    $AWS_EC2 terminate-instances --instance-ids "$ALPHA_INST" --profile hive-team-beta
+echo "  Beta cannot terminate Alpha's instance"
+
+expect_error "InvalidInstanceID.NotFound" \
+    $AWS_EC2 get-console-output --instance-id "$ALPHA_INST" --profile hive-team-beta
+echo "  Beta cannot get console output of Alpha's instance"
+
+echo "  Instance scoping passed"
+
+# --- 7b: Volume Scoping ---
+echo ""
+echo "Step 7b: Volume Scoping"
+echo "----------------------------------------"
+
+ALPHA_VOL=$($AWS_EC2 create-volume --availability-zone ap-southeast-2a --size 10 \
+    --volume-type gp3 --profile hive-team-alpha | jq -r '.VolumeId')
+echo "  Alpha volume: $ALPHA_VOL"
+
+BETA_VOL=$($AWS_EC2 create-volume --availability-zone ap-southeast-2a --size 10 \
+    --volume-type gp3 --profile hive-team-beta | jq -r '.VolumeId')
+echo "  Beta volume: $BETA_VOL"
+
+# Describe isolation
+ALPHA_VOLS=$($AWS_EC2 describe-volumes --profile hive-team-alpha \
+    --query 'Volumes[].VolumeId' --output text)
+if echo "$ALPHA_VOLS" | grep -q "$BETA_VOL"; then
+    echo "  ERROR: Alpha can see Beta's volume"
+    exit 1
+fi
+echo "  Alpha sees only own volumes"
+
+# Cross-account operations
+expect_error "InvalidVolume.NotFound" \
+    $AWS_EC2 describe-volumes --volume-ids "$BETA_VOL" --profile hive-team-alpha
+echo "  Alpha cannot describe Beta's volume by ID"
+
+expect_error "InvalidVolume.NotFound" \
+    $AWS_EC2 delete-volume --volume-id "$ALPHA_VOL" --profile hive-team-beta
+echo "  Beta cannot delete Alpha's volume"
+
+expect_error "InvalidVolume.NotFound" \
+    $AWS_EC2 attach-volume --volume-id "$ALPHA_VOL" \
+    --instance-id "$BETA_INST" --device /dev/sdf --profile hive-team-beta
+echo "  Beta cannot attach Alpha's volume"
+
+# Attach Alpha's volume, then test cross-account detach
+$AWS_EC2 attach-volume --volume-id "$ALPHA_VOL" \
+    --instance-id "$ALPHA_INST" --device /dev/sdf --profile hive-team-alpha > /dev/null
+sleep 2
+
+expect_error "InvalidVolume.NotFound" \
+    $AWS_EC2 detach-volume --volume-id "$ALPHA_VOL" --profile hive-team-beta
+echo "  Beta cannot detach Alpha's volume"
+
+expect_error "InvalidVolume.NotFound" \
+    $AWS_EC2 modify-volume --volume-id "$ALPHA_VOL" --size 20 --profile hive-team-beta
+echo "  Beta cannot modify Alpha's volume"
+
+# Detach for later cleanup
+$AWS_EC2 detach-volume --volume-id "$ALPHA_VOL" --profile hive-team-alpha > /dev/null
+sleep 2
+
+echo "  Volume scoping passed"
+
+# --- 7c: Key Pair Scoping ---
+echo ""
+echo "Step 7c: Key Pair Scoping"
+echo "----------------------------------------"
+
+$AWS_EC2 create-key-pair --key-name alpha-key --profile hive-team-alpha > /dev/null
+ALPHA_KEYPAIR_ID=$($AWS_EC2 describe-key-pairs --key-names alpha-key \
+    --profile hive-team-alpha --query 'KeyPairs[0].KeyPairId' --output text)
+echo "  Alpha key: alpha-key ($ALPHA_KEYPAIR_ID)"
+
+$AWS_EC2 create-key-pair --key-name beta-key --profile hive-team-beta > /dev/null
+echo "  Beta key: beta-key"
+
+# Describe isolation
+ALPHA_KEYS=$($AWS_EC2 describe-key-pairs --profile hive-team-alpha \
+    --query 'KeyPairs[].KeyName' --output text)
+if echo "$ALPHA_KEYS" | grep -q "beta-key"; then
+    echo "  ERROR: Alpha can see Beta's key"
+    exit 1
+fi
+echo "  Alpha sees only own keys"
+
+# Same name, different accounts
+$AWS_EC2 create-key-pair --key-name shared-name --profile hive-team-alpha > /dev/null
+$AWS_EC2 create-key-pair --key-name shared-name --profile hive-team-beta > /dev/null
+ALPHA_SHARED_ID=$($AWS_EC2 describe-key-pairs --key-names shared-name \
+    --profile hive-team-alpha --query 'KeyPairs[0].KeyPairId' --output text)
+BETA_SHARED_ID=$($AWS_EC2 describe-key-pairs --key-names shared-name \
+    --profile hive-team-beta --query 'KeyPairs[0].KeyPairId' --output text)
+if [ "$ALPHA_SHARED_ID" == "$BETA_SHARED_ID" ]; then
+    echo "  ERROR: Same KeyPairId for shared-name in both accounts"
+    exit 1
+fi
+echo "  Namespace isolation: alpha=$ALPHA_SHARED_ID, beta=$BETA_SHARED_ID"
+
+# Cross-account delete (idempotent, but shouldn't affect other account)
+$AWS_EC2 delete-key-pair --key-name alpha-key --profile hive-team-beta
+ALPHA_KEY_CHECK=$($AWS_EC2 describe-key-pairs --key-names alpha-key \
+    --profile hive-team-alpha --query 'KeyPairs[0].KeyPairId' --output text)
+if [ "$ALPHA_KEY_CHECK" != "$ALPHA_KEYPAIR_ID" ]; then
+    echo "  ERROR: Beta's delete affected Alpha's key"
+    exit 1
+fi
+echo "  Cross-account delete had no effect on Alpha's key"
+
+# Import key pair — account scoped
+ssh-keygen -t ed25519 -f /tmp/test-import-key -N "" -q
+$AWS_EC2 import-key-pair --key-name imported-key \
+    --public-key-material fileb:///tmp/test-import-key.pub --profile hive-team-alpha > /dev/null
+BETA_IMPORT_CHECK=$($AWS_EC2 describe-key-pairs --profile hive-team-beta \
+    --query 'KeyPairs[].KeyName' --output text)
+if echo "$BETA_IMPORT_CHECK" | grep -q "imported-key"; then
+    echo "  ERROR: Beta can see Alpha's imported key"
+    exit 1
+fi
+echo "  Imported key invisible to Beta"
+rm -f /tmp/test-import-key /tmp/test-import-key.pub
+
+echo "  Key pair scoping passed"
+
+# --- 7d: Snapshot Scoping ---
+echo ""
+echo "Step 7d: Snapshot Scoping"
+echo "----------------------------------------"
+
+ALPHA_SNAP=$($AWS_EC2 create-snapshot --volume-id "$ALPHA_VOL" \
+    --description "Alpha snapshot" --profile hive-team-alpha | jq -r '.SnapshotId')
+echo "  Alpha snapshot: $ALPHA_SNAP"
+
+BETA_SNAP=$($AWS_EC2 create-snapshot --volume-id "$BETA_VOL" \
+    --description "Beta snapshot" --profile hive-team-beta | jq -r '.SnapshotId')
+echo "  Beta snapshot: $BETA_SNAP"
+
+# Describe isolation
+ALPHA_SNAPS=$($AWS_EC2 describe-snapshots --owner-ids self --profile hive-team-alpha \
+    --query 'Snapshots[].SnapshotId' --output text)
+if echo "$ALPHA_SNAPS" | grep -q "$BETA_SNAP"; then
+    echo "  ERROR: Alpha can see Beta's snapshot"
+    exit 1
+fi
+echo "  Alpha sees only own snapshots"
+
+# OwnerId verification
+ALPHA_SNAP_OWNER=$($AWS_EC2 describe-snapshots --owner-ids self --profile hive-team-alpha \
+    --query 'Snapshots[0].OwnerId' --output text)
+if [ "$ALPHA_SNAP_OWNER" != "$ALPHA_ACCOUNT" ]; then
+    echo "  ERROR: Snapshot OwnerId mismatch: expected $ALPHA_ACCOUNT, got $ALPHA_SNAP_OWNER"
+    exit 1
+fi
+echo "  Alpha snapshot OwnerId correct"
+
+# Cross-account delete
+expect_error "UnauthorizedOperation" \
+    $AWS_EC2 delete-snapshot --snapshot-id "$ALPHA_SNAP" --profile hive-team-beta
+echo "  Beta cannot delete Alpha's snapshot"
+
+# Cross-account snapshot from other's volume
+expect_error "InvalidVolume.NotFound" \
+    $AWS_EC2 create-snapshot --volume-id "$ALPHA_VOL" \
+    --description "stolen" --profile hive-team-beta
+echo "  Beta cannot snapshot Alpha's volume"
+
+echo "  Snapshot scoping passed"
+
+# --- 7e: VPC/Subnet Scoping ---
+echo ""
+echo "Step 7e: VPC/Subnet Scoping"
+echo "----------------------------------------"
+
+ALPHA_VPC=$($AWS_EC2 create-vpc --cidr-block 10.0.0.0/16 \
+    --profile hive-team-alpha --query 'Vpc.VpcId' --output text)
+echo "  Alpha VPC: $ALPHA_VPC"
+
+BETA_VPC=$($AWS_EC2 create-vpc --cidr-block 10.0.0.0/16 \
+    --profile hive-team-beta --query 'Vpc.VpcId' --output text)
+echo "  Beta VPC: $BETA_VPC (same CIDR — no conflict)"
+
+# Describe isolation
+ALPHA_VPCS=$($AWS_EC2 describe-vpcs --profile hive-team-alpha \
+    --query 'Vpcs[].VpcId' --output text)
+if echo "$ALPHA_VPCS" | grep -q "$BETA_VPC"; then
+    echo "  ERROR: Alpha can see Beta's VPC"
+    exit 1
+fi
+echo "  VPC describe isolation OK"
+
+expect_error "InvalidVpcID.NotFound" \
+    $AWS_EC2 describe-vpcs --vpc-ids "$BETA_VPC" --profile hive-team-alpha
+echo "  Alpha cannot describe Beta's VPC by ID"
+
+expect_error "InvalidVpcID.NotFound" \
+    $AWS_EC2 delete-vpc --vpc-id "$ALPHA_VPC" --profile hive-team-beta
+echo "  Beta cannot delete Alpha's VPC"
+
+# Create subnets
+ALPHA_SUBNET=$($AWS_EC2 create-subnet --vpc-id "$ALPHA_VPC" --cidr-block 10.0.1.0/24 \
+    --profile hive-team-alpha --query 'Subnet.SubnetId' --output text)
+echo "  Alpha subnet: $ALPHA_SUBNET"
+
+BETA_SUBNET=$($AWS_EC2 create-subnet --vpc-id "$BETA_VPC" --cidr-block 10.0.1.0/24 \
+    --profile hive-team-beta --query 'Subnet.SubnetId' --output text)
+echo "  Beta subnet: $BETA_SUBNET"
+
+# Subnet describe isolation
+ALPHA_SUBNETS=$($AWS_EC2 describe-subnets --profile hive-team-alpha \
+    --query 'Subnets[].SubnetId' --output text)
+if echo "$ALPHA_SUBNETS" | grep -q "$BETA_SUBNET"; then
+    echo "  ERROR: Alpha can see Beta's subnet"
+    exit 1
+fi
+echo "  Subnet describe isolation OK"
+
+expect_error "InvalidVpcID.NotFound" \
+    $AWS_EC2 create-subnet --vpc-id "$ALPHA_VPC" --cidr-block 10.0.2.0/24 \
+    --profile hive-team-beta
+echo "  Beta cannot create subnet in Alpha's VPC"
+
+expect_error "InvalidSubnetID.NotFound" \
+    $AWS_EC2 delete-subnet --subnet-id "$ALPHA_SUBNET" --profile hive-team-beta
+echo "  Beta cannot delete Alpha's subnet"
+
+echo "  VPC/Subnet scoping passed"
+
+# --- 7f: IGW + EIGW Scoping ---
+echo ""
+echo "Step 7f: IGW + EIGW Scoping"
+echo "----------------------------------------"
+
+ALPHA_IGW=$($AWS_EC2 create-internet-gateway --profile hive-team-alpha \
+    --query 'InternetGateway.InternetGatewayId' --output text)
+echo "  Alpha IGW: $ALPHA_IGW"
+
+BETA_IGW=$($AWS_EC2 create-internet-gateway --profile hive-team-beta \
+    --query 'InternetGateway.InternetGatewayId' --output text)
+echo "  Beta IGW: $BETA_IGW"
+
+# IGW describe isolation
+ALPHA_IGWS=$($AWS_EC2 describe-internet-gateways --profile hive-team-alpha \
+    --query 'InternetGateways[].InternetGatewayId' --output text)
+if echo "$ALPHA_IGWS" | grep -q "$BETA_IGW"; then
+    echo "  ERROR: Alpha can see Beta's IGW"
+    exit 1
+fi
+echo "  IGW describe isolation OK"
+
+expect_error "InvalidInternetGatewayID.NotFound" \
+    $AWS_EC2 describe-internet-gateways --internet-gateway-ids "$BETA_IGW" \
+    --profile hive-team-alpha
+echo "  Alpha cannot describe Beta's IGW by ID"
+
+expect_error "InvalidInternetGatewayID.NotFound" \
+    $AWS_EC2 delete-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --profile hive-team-beta
+echo "  Beta cannot delete Alpha's IGW"
+
+expect_error "InvalidInternetGatewayID.NotFound" \
+    $AWS_EC2 attach-internet-gateway --internet-gateway-id "$BETA_IGW" \
+    --vpc-id "$ALPHA_VPC" --profile hive-team-alpha
+echo "  Alpha cannot attach Beta's IGW to own VPC"
+
+# Attach Alpha's IGW, test cross-account detach
+$AWS_EC2 attach-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --vpc-id "$ALPHA_VPC" --profile hive-team-alpha > /dev/null
+expect_error "InvalidInternetGatewayID.NotFound" \
+    $AWS_EC2 detach-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --vpc-id "$ALPHA_VPC" --profile hive-team-beta
+echo "  Beta cannot detach Alpha's IGW"
+
+# EIGW
+ALPHA_EIGW=$($AWS_EC2 create-egress-only-internet-gateway --vpc-id "$ALPHA_VPC" \
+    --profile hive-team-alpha \
+    --query 'EgressOnlyInternetGateway.EgressOnlyInternetGatewayId' --output text)
+echo "  Alpha EIGW: $ALPHA_EIGW"
+
+BETA_EIGW=$($AWS_EC2 create-egress-only-internet-gateway --vpc-id "$BETA_VPC" \
+    --profile hive-team-beta \
+    --query 'EgressOnlyInternetGateway.EgressOnlyInternetGatewayId' --output text)
+echo "  Beta EIGW: $BETA_EIGW"
+
+# EIGW describe isolation
+ALPHA_EIGWS=$($AWS_EC2 describe-egress-only-internet-gateways --profile hive-team-alpha \
+    --query 'EgressOnlyInternetGateways[].EgressOnlyInternetGatewayId' --output text)
+if echo "$ALPHA_EIGWS" | grep -q "$BETA_EIGW"; then
+    echo "  ERROR: Alpha can see Beta's EIGW"
+    exit 1
+fi
+echo "  EIGW describe isolation OK"
+
+# Cross-account EIGW delete (verify Alpha's still exists after Beta's attempt)
+set +e
+$AWS_EC2 delete-egress-only-internet-gateway \
+    --egress-only-internet-gateway-id "$ALPHA_EIGW" --profile hive-team-beta 2>/dev/null
+set -e
+ALPHA_EIGW_CHECK=$($AWS_EC2 describe-egress-only-internet-gateways --profile hive-team-alpha \
+    --query 'EgressOnlyInternetGateways[].EgressOnlyInternetGatewayId' --output text)
+if ! echo "$ALPHA_EIGW_CHECK" | grep -q "$ALPHA_EIGW"; then
+    echo "  ERROR: Alpha's EIGW was deleted by Beta"
+    exit 1
+fi
+echo "  Beta cannot delete Alpha's EIGW"
+
+echo "  IGW + EIGW scoping passed"
+
+# --- 7g: Account Settings ---
+echo ""
+echo "Step 7g: Account Settings"
+echo "----------------------------------------"
+
+$AWS_EC2 enable-ebs-encryption-by-default --profile hive-team-alpha > /dev/null
+BETA_ENC=$($AWS_EC2 get-ebs-encryption-by-default --profile hive-team-beta \
+    --query 'EbsEncryptionByDefault' --output text)
+if [ "$BETA_ENC" != "False" ]; then
+    echo "  ERROR: Alpha's encryption setting leaked to Beta (got $BETA_ENC)"
+    exit 1
+fi
+echo "  Alpha enable did not affect Beta"
+
+$AWS_EC2 enable-ebs-encryption-by-default --profile hive-team-beta > /dev/null
+$AWS_EC2 disable-ebs-encryption-by-default --profile hive-team-alpha > /dev/null
+ALPHA_ENC=$($AWS_EC2 get-ebs-encryption-by-default --profile hive-team-alpha \
+    --query 'EbsEncryptionByDefault' --output text)
+BETA_ENC=$($AWS_EC2 get-ebs-encryption-by-default --profile hive-team-beta \
+    --query 'EbsEncryptionByDefault' --output text)
+if [ "$ALPHA_ENC" != "False" ] || [ "$BETA_ENC" != "True" ]; then
+    echo "  ERROR: Independent settings failed: alpha=$ALPHA_ENC beta=$BETA_ENC"
+    exit 1
+fi
+echo "  Independent toggle verified: alpha=$ALPHA_ENC, beta=$BETA_ENC"
+$AWS_EC2 disable-ebs-encryption-by-default --profile hive-team-beta > /dev/null
+
+echo "  Account settings scoping passed"
+
+# --- 7h: Global Resources ---
+echo ""
+echo "Step 7h: Global Resources"
+echo "----------------------------------------"
+
+ALPHA_REGIONS=$($AWS_EC2 describe-regions --profile hive-team-alpha \
+    --query 'Regions[].RegionName' --output text)
+BETA_REGIONS=$($AWS_EC2 describe-regions --profile hive-team-beta \
+    --query 'Regions[].RegionName' --output text)
+if [ "$ALPHA_REGIONS" != "$BETA_REGIONS" ]; then
+    echo "  ERROR: Regions differ between accounts"
+    exit 1
+fi
+echo "  Regions identical"
+
+ALPHA_AZS=$($AWS_EC2 describe-availability-zones --profile hive-team-alpha \
+    --query 'AvailabilityZones[].ZoneName' --output text)
+BETA_AZS=$($AWS_EC2 describe-availability-zones --profile hive-team-beta \
+    --query 'AvailabilityZones[].ZoneName' --output text)
+if [ "$ALPHA_AZS" != "$BETA_AZS" ]; then
+    echo "  ERROR: AZs differ between accounts"
+    exit 1
+fi
+echo "  Availability zones identical"
+
+ALPHA_TYPES=$($AWS_EC2 describe-instance-types --profile hive-team-alpha \
+    --query 'InstanceTypes[].InstanceType' --output text | tr '\t' '\n' | sort)
+BETA_TYPES=$($AWS_EC2 describe-instance-types --profile hive-team-beta \
+    --query 'InstanceTypes[].InstanceType' --output text | tr '\t' '\n' | sort)
+if [ "$ALPHA_TYPES" != "$BETA_TYPES" ]; then
+    echo "  ERROR: Instance types differ between accounts"
+    exit 1
+fi
+echo "  Instance types identical"
+
+echo "  Global resources passed"
+
+# --- Step 8: Edge Cases ---
+echo ""
+echo "Step 8: Edge Cases"
+echo "----------------------------------------"
+
+# Empty account (Gamma)
+echo "  Creating empty Gamma account..."
+GAMMA_OUTPUT=$(./bin/hive admin account create --name "Team Gamma" --config "$HOME/node1/config/hive.toml" 2>&1)
+GAMMA_KEY_ID=$(echo "$GAMMA_OUTPUT" | grep "Access Key ID:" | awk '{print $NF}')
+GAMMA_SECRET=$(echo "$GAMMA_OUTPUT" | grep "Secret Access Key:" | awk '{print $NF}')
+aws configure set aws_access_key_id "$GAMMA_KEY_ID" --profile hive-team-gamma
+aws configure set aws_secret_access_key "$GAMMA_SECRET" --profile hive-team-gamma
+aws configure set region us-east-1 --profile hive-team-gamma
+
+GAMMA_INSTANCES=$($AWS_EC2 describe-instances --profile hive-team-gamma \
+    --query 'Reservations' --output text)
+if [ -n "$GAMMA_INSTANCES" ] && [ "$GAMMA_INSTANCES" != "None" ]; then
+    echo "  ERROR: Gamma has instances"
+    exit 1
+fi
+echo "  Gamma: no instances"
+
+# Skip volume check: root-account volumes (empty TenantID) are visible to all accounts by design
+echo "  Gamma: volumes skipped (root legacy volumes visible to all)"
+
+GAMMA_KEYS=$($AWS_EC2 describe-key-pairs --profile hive-team-gamma \
+    --query 'KeyPairs' --output text)
+if [ -n "$GAMMA_KEYS" ] && [ "$GAMMA_KEYS" != "None" ]; then
+    echo "  ERROR: Gamma has key pairs"
+    exit 1
+fi
+echo "  Gamma: no key pairs"
+
+# Root isolation from tenants
+echo "  Verifying root isolation from tenants..."
+ROOT_INSTANCE_CHECK=$($AWS_EC2 describe-instances \
+    --query 'Reservations[].Instances[].InstanceId' --output text)
+if echo "$ROOT_INSTANCE_CHECK" | grep -q "$ALPHA_INST"; then
+    echo "  ERROR: Root can see Alpha's instance"
+    exit 1
+fi
+echo "  Root cannot see tenant instances"
+
+# Non-existent resource IDs — same error as cross-account
+expect_error "InvalidVolume.NotFound" \
+    $AWS_EC2 delete-volume --volume-id vol-00000000000000000 --profile hive-team-alpha
+echo "  Non-existent volume: same error as cross-account"
+
+expect_error "InvalidSnapshot.NotFound" \
+    $AWS_EC2 delete-snapshot --snapshot-id snap-00000000000000000 --profile hive-team-alpha
+echo "  Non-existent snapshot: same error as cross-account"
+
+# Race condition: parallel key creation from both accounts
+echo "  Testing parallel key creation (race condition)..."
+for i in $(seq 1 5); do
+    $AWS_EC2 create-key-pair --key-name "race-alpha-$i" --profile hive-team-alpha > /dev/null &
+    $AWS_EC2 create-key-pair --key-name "race-beta-$i" --profile hive-team-beta > /dev/null &
+done
+wait
+
+ALPHA_RACE_COUNT=$($AWS_EC2 describe-key-pairs --profile hive-team-alpha \
+    --query 'KeyPairs[].KeyName' --output text | tr '\t' '\n' | grep -c "race-alpha" || true)
+if [ "$ALPHA_RACE_COUNT" -ne 5 ]; then
+    echo "  ERROR: Expected 5 race-alpha keys, got $ALPHA_RACE_COUNT"
+    exit 1
+fi
+ALPHA_RACE_LEAK=$($AWS_EC2 describe-key-pairs --profile hive-team-alpha \
+    --query 'KeyPairs[].KeyName' --output text | tr '\t' '\n' | grep -c "race-beta" || true)
+if [ "$ALPHA_RACE_LEAK" -ne 0 ]; then
+    echo "  ERROR: Alpha sees Beta's race keys (cross-contamination)"
+    exit 1
+fi
+echo "  Parallel key creation: no cross-contamination ($ALPHA_RACE_COUNT alpha keys, 0 beta leaks)"
+
+echo "  Edge cases passed"
+
+# --- Step 9: EC2 + IAM Cleanup ---
+echo ""
+echo "Step 9: EC2 + IAM Cleanup"
+echo "========================================"
+
+# Terminate instances
+echo "  Terminating account-scoped instances..."
+$AWS_EC2 terminate-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha > /dev/null
+$AWS_EC2 terminate-instances --instance-ids "$BETA_INST" --profile hive-team-beta > /dev/null
+
+COUNT=0
+while [ $COUNT -lt 30 ]; do
+    A_STATE=$($AWS_EC2 describe-instances --instance-ids "$ALPHA_INST" --profile hive-team-alpha \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null || echo "terminated")
+    B_STATE=$($AWS_EC2 describe-instances --instance-ids "$BETA_INST" --profile hive-team-beta \
+        --query 'Reservations[0].Instances[0].State.Name' --output text 2>/dev/null || echo "terminated")
+    if [ "$A_STATE" == "terminated" ] && [ "$B_STATE" == "terminated" ]; then
+        break
+    fi
+    sleep 2
+    COUNT=$((COUNT + 1))
+done
+echo "  Instances terminated"
+
+# Delete snapshots
+echo "  Deleting snapshots..."
+$AWS_EC2 delete-snapshot --snapshot-id "$ALPHA_SNAP" --profile hive-team-alpha 2>/dev/null || true
+$AWS_EC2 delete-snapshot --snapshot-id "$BETA_SNAP" --profile hive-team-beta 2>/dev/null || true
+
+# Delete volumes
+sleep 3
+echo "  Deleting volumes..."
+$AWS_EC2 delete-volume --volume-id "$ALPHA_VOL" --profile hive-team-alpha 2>/dev/null || true
+$AWS_EC2 delete-volume --volume-id "$BETA_VOL" --profile hive-team-beta 2>/dev/null || true
+
+# Delete key pairs
+echo "  Deleting key pairs..."
+for key in alpha-key alpha-instance-key shared-name imported-key; do
+    $AWS_EC2 delete-key-pair --key-name "$key" --profile hive-team-alpha 2>/dev/null || true
+done
+for key in beta-key beta-instance-key shared-name; do
+    $AWS_EC2 delete-key-pair --key-name "$key" --profile hive-team-beta 2>/dev/null || true
+done
+for i in $(seq 1 5); do
+    $AWS_EC2 delete-key-pair --key-name "race-alpha-$i" --profile hive-team-alpha 2>/dev/null || true
+    $AWS_EC2 delete-key-pair --key-name "race-beta-$i" --profile hive-team-beta 2>/dev/null || true
+done
+
+# Delete EIGWs
+echo "  Deleting EIGWs..."
+$AWS_EC2 delete-egress-only-internet-gateway \
+    --egress-only-internet-gateway-id "$ALPHA_EIGW" --profile hive-team-alpha 2>/dev/null || true
+$AWS_EC2 delete-egress-only-internet-gateway \
+    --egress-only-internet-gateway-id "$BETA_EIGW" --profile hive-team-beta 2>/dev/null || true
+
+# Detach + delete IGWs
+echo "  Deleting IGWs..."
+$AWS_EC2 detach-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --vpc-id "$ALPHA_VPC" --profile hive-team-alpha 2>/dev/null || true
+$AWS_EC2 delete-internet-gateway --internet-gateway-id "$ALPHA_IGW" \
+    --profile hive-team-alpha 2>/dev/null || true
+$AWS_EC2 delete-internet-gateway --internet-gateway-id "$BETA_IGW" \
+    --profile hive-team-beta 2>/dev/null || true
+
+# Delete subnets
+echo "  Deleting subnets..."
+$AWS_EC2 delete-subnet --subnet-id "$ALPHA_SUBNET" --profile hive-team-alpha 2>/dev/null || true
+$AWS_EC2 delete-subnet --subnet-id "$BETA_SUBNET" --profile hive-team-beta 2>/dev/null || true
+
+# Delete VPCs
+echo "  Deleting VPCs..."
+$AWS_EC2 delete-vpc --vpc-id "$ALPHA_VPC" --profile hive-team-alpha 2>/dev/null || true
+$AWS_EC2 delete-vpc --vpc-id "$BETA_VPC" --profile hive-team-beta 2>/dev/null || true
+
+echo "  EC2 resources cleaned up"
+
+# IAM cleanup (originally Step 7)
+echo "  Cleaning up IAM resources..."
+
 # Beta cleanup
-echo "  Cleaning up Beta account resources..."
 aws $AWS_EP iam detach-user-policy --user-name alice \
     --policy-arn "arn:aws:iam::${BETA_ACCOUNT}:policy/EC2ReadOnly" --profile hive-team-beta
 aws $AWS_EP iam delete-access-key --user-name alice \
@@ -1419,19 +2030,18 @@ aws $AWS_EP iam delete-user --user-name dev-user --profile hive-team-beta
 aws $AWS_EP iam delete-policy \
     --policy-arn "arn:aws:iam::${BETA_ACCOUNT}:policy/EC2ReadOnly" --profile hive-team-beta
 
-# Alpha cleanup (alice already deleted)
-echo "  Cleaning up Alpha account resources..."
+# Alpha cleanup (alice already deleted in Step 6)
 aws $AWS_EP iam delete-user --user-name team-member --profile hive-team-alpha
 aws $AWS_EP iam delete-policy \
     --policy-arn "arn:aws:iam::${ALPHA_ACCOUNT}:policy/EC2ReadOnly" --profile hive-team-alpha
 
 # Clean up AWS CLI profiles
-for p in hive-team-alpha hive-team-beta hive-alpha-alice hive-beta-alice; do
+for p in hive-team-alpha hive-team-beta hive-alpha-alice hive-beta-alice hive-team-gamma; do
     aws configure set aws_access_key_id "" --profile $p 2>/dev/null || true
     aws configure set aws_secret_access_key "" --profile $p 2>/dev/null || true
 done
 
-echo "  IAM account cleanup complete"
+echo "  IAM + EC2 account cleanup complete"
 echo ""
 echo "  IAM Accounts & Cross-Account Isolation tests passed"