cdk-organizations
An AWS CDK construct library for managing AWS Organizations, including OUs, accounts, and service control policies.
What is cdk-organizations?
CDK Organizations is an AWS CDK construct library that provides infrastructure-as-code capabilities for managing AWS Organizations. It allows developers to programmatically create and manage AWS Organizations, organizational units (OUs), member accounts, and service control policies (SCPs) using familiar CDK patterns. The library solves the problem of manually configuring AWS Organizations through the console or CLI by enabling automated, repeatable deployments.
AWS infrastructure engineers, DevOps teams, and platform engineers who manage multi-account AWS environments and want to automate organizational structure using AWS CDK.
Developers choose CDK Organizations because it provides a type-safe, intuitive way to manage AWS Organizations using infrastructure-as-code principles, eliminating manual console work and enabling version-controlled, repeatable deployments of complex organizational structures.
Overview
Manage AWS organizations, organizational units (OU), accounts and service control policies (SCP).
Use Cases
Best For
- Automating AWS account creation and management in multi-account environments
- Defining organizational hierarchies with OUs using infrastructure-as-code
- Implementing and enforcing service control policies (SCPs) across accounts
- Setting up delegated administrators for AWS services programmatically
- Managing AWS Organizations resources alongside other CDK infrastructure
- Creating reproducible AWS account structures for different environments (dev, staging, prod)
Not Ideal For
- Teams using Terraform or CloudFormation without AWS CDK
- Organizations with simple, static account structures that rarely change
- Projects requiring real-time, dynamic account provisioning outside deployment cycles
- Environments needing cross-cloud or hybrid cloud management beyond AWS
Pros & Cons
Pros
Leverages AWS CDK's programming language support for compile-time checking and autocompletion, as highlighted in the Philosophy section promoting type-safe management.
Supports all key AWS Organizations features including OUs, accounts, SCPs, tag policies, and delegated administrators, detailed in the Key Features list and Usage examples.
Available in TypeScript, Python, C#, and Java via package managers like npm, PyPI, and NuGet, making it accessible across different development teams, as shown in the Install section.
Can automatically import existing AWS Organizations, OUs, and accounts using the importOnDuplicate property, reducing migration friction, as mentioned in the Organization and Account usage notes.
Cons
Requires the deploying stack to be in the management account of the AWS Organization, limiting flexibility for deployments from other accounts, as stated in the Limitations section.
Does not automatically delete organizations or accounts when constructs are removed; users must manually clean up resources, as admitted in the Usage notes for Organization and Account deletion.
Defaults to the us-east-1 endpoint for AWS Organizations operations, which may cause latency or compliance issues, with only partial configuration via environment variables like CDK_AWS_PARTITION, as noted in Limitations.
Requires pre-configuring an IAM user with AdministratorAccess and exporting credentials, adding overhead compared to simpler CLI tools, as detailed in the Getting Started steps.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.