@rpallas/outcrop-account

Account and environment baseline for outcrop. It provisions what every service built with @rpallas/outcrop expects to find in an AWS account and publishes it to the SSM contract (/platform/..., see ADR 0003).

npx @rpallas/outcrop-cli create account my-platform --owner my-org --domain example.com

// bin/app.ts
import { App } from "aws-cdk-lib";
import { createAccountBaseline, defineAccountConfig } from "@rpallas/outcrop-account";

const config = defineAccountConfig({
  project: "my-platform",
  environments: {
    dev: {
      account: "111111111111",
      region: "eu-west-1",
      domain: "dev.example.com",
      alertEmails: ["platform-alerts@example.com"],
      monthlyBudgetUsd: 200,
      github: [{ owner: "my-org", repo: "orders" }],
    },
    prod: {
      account: "222222222222",
      region: "eu-west-1",
      domain: "example.com",
      protected: true,
      github: [{ owner: "my-org", repo: "orders", allowPullRequests: false }],
    },
  },
});

createAccountBaseline(new App(), {
  config,
  modules: {
    githubOidc: true,
    accountSettings: true,
    dns: true,
    alerting: true,
    eventBus: true,
    encryption: true,
    sharedParameters: { values: { "auth0-domain": "example.eu.auth0.com" } },
    sharedSecrets: { secrets: { "neon-api-key": {} } },
    budgets: true,
    security: true,
    logRetention: true,
  },
});

cdk deploy --all -c env=dev creates PlatformAccount-dev in the dev account and, when DNS is on outside us-east-1, PlatformAccountEdge-dev holding the CloudFront certificate.

Modules

Every module is a standalone construct taking { context, ...options }; AccountBaseline composes them and wires the KMS key, topics and parameters together.

Module	Creates	Publishes
GitHubOidc	OIDC provider, deploy + read-only role per repository, trust on sub claims (ADR 0005)	account/deploy/oidc-provider-arn, role-arn/{repo}
AccountSettings	IAM alias and password policy, S3 Block Public Access, EBS default encryption, Access Analyzer	-
Dns / EdgeCertificate	Hosted zone, delegation (same or cross-account), regional and us-east-1 wildcard certificates	env/{env}/dns/*, env/{env}/certs/*
Alerting	SNS topic per severity, email subscriptions, publish permissions for alarms/events/budgets	env/{env}/alerts/topic-arn/{severity}
EventBusModule	Event bus, archive, org/account PutEvents policies, optional all-events log	env/{env}/events/bus-name, bus-arn
Encryption	Rotating KMS key with alias and policies for platform services	account/kms/key-arn, key-id
SharedParameters / SharedSecrets	Map-driven config values and generated secrets	config/{key}, secrets/{name}/arn
Budgets	Monthly cost budget with actual and forecast notifications	-
Security	CloudTrail, AWS Config, GuardDuty, Security Hub (each optional)	account/security/cloudtrail-bucket-name
Network	VPC (isolated by default), gateway and interface endpoints, Lambda security group, flow logs	account/vpc/*
LogRetention	Scheduled and event-driven sweeper applying the default log retention	account/log-retention-days

Protected environments (protected: true) retain stateful resources on delete, enable stack termination protection and never trust pull_request tokens.

Deploy roles

Deploy roles can only assume the CDK bootstrap roles (cdk-<qualifier>-*) for the account and region and read CloudFormation stack state; permissions are therefore defined by cdk bootstrap, not by this package. Stack outputs DeployRoleArn<Owner><Repo> and ReadOnlyRoleArn<Owner><Repo> are the values for the AWS_DEPLOY_ROLE_ARN_<ENV> and AWS_READONLY_ROLE_ARN_<ENV> repository variables.

Organisation rollout

• PlatformStackSet deploys any CDK stack to every account of an OU (service-managed, auto deployment, addDependency ordering) from the management or a delegated administrator account. The template is synthesised in a nested stage and embedded inline, or uploaded as an asset above 50 KB. Templates must be asset-free (inline Lambda code) unless every target account has the CDK asset bucket.
• OrganizationsAccessRole creates narrowly trusted cross-account roles, with presets dnsDelegation(zone) (for CrossAccountZoneDelegationRecord) and parameterReader().
• AccountNameLookup resolves the Organizations account name at deploy time and environmentFromAccountName("my-platform-dev", { apexDomain: "example.com", workloadPrefix: "my-platform-" }) derives { env: "dev", domain: "dev.example.com" } for account-per-environment layouts.

new PlatformStackSet(adminStack, "Baseline", {
  stackSetName: "platform-baseline",
  template: (scope) => new AccountBaselineTemplateStack(scope, "Template"),
  targets: { organizationalUnitIds: ["ou-example-workloads"], regions: ["eu-west-1"] },
});

Classes

AccountBaseline

Defined in: account-baseline.ts:59

Composes the opt-in account modules and wires them together: the KMS key encrypts topics, secrets and audit logs; alert topics receive budget notifications; every module publishes to the SSM contract (ADR 0003). Each module is also usable standalone.

Extends

• Construct

Constructors

Constructor

new AccountBaseline(
   scope, 
   id, 
   props
): AccountBaseline;

Defined in: account-baseline.ts:74

Parameters

Parameter	Type
scope	Construct
id	string
props	AccountBaselineProps

Returns

AccountBaseline

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
accountSettings?	readonly	AccountSettings	account-baseline.ts:63
alerting?	readonly	Alerting	account-baseline.ts:65
budgets?	readonly	Budgets	account-baseline.ts:69
context	readonly	AccountEnvContext	account-baseline.ts:60
dns?	readonly	Dns	account-baseline.ts:64
encryption?	readonly	Encryption	account-baseline.ts:61
eventBus?	readonly	EventBusModule	account-baseline.ts:66
githubOidc?	readonly	GitHubOidc	account-baseline.ts:62
logRetention?	readonly	LogRetention	account-baseline.ts:72
network?	readonly	Network	account-baseline.ts:71
security?	readonly	Security	account-baseline.ts:70
sharedParameters?	readonly	SharedParameters	account-baseline.ts:67
sharedSecrets?	readonly	SharedSecrets	account-baseline.ts:68

---

AccountBaselineStack

Defined in: account-baseline-stack.ts:22

Stack wrapper around AccountBaseline that resolves the environment from context, targets the configured account/region and names itself PlatformAccount-<env>.

Extends

• Stack

Constructors

Constructor

new AccountBaselineStack(
   scope, 
   id, 
   props
): AccountBaselineStack;

Defined in: account-baseline-stack.ts:26

Parameters

Parameter	Type
scope	Construct
id	string
props	AccountBaselineStackProps

Returns

AccountBaselineStack

Overrides

Stack.constructor

Properties

Property	Modifier	Type	Defined in
baseline	readonly	AccountBaseline	account-baseline-stack.ts:24
context	readonly	AccountEnvContext	account-baseline-stack.ts:23

---

AccountEdgeStack

Defined in: account-baseline-stack.ts:52

Companion stack in us-east-1 holding the CloudFront certificate for the environment domain. Created automatically by createAccountBaseline when the DNS module is on and the home region is not us-east-1.

Extends

• Stack

Constructors

Constructor

new AccountEdgeStack(
   scope, 
   id, 
   props
): AccountEdgeStack;

Defined in: account-baseline-stack.ts:55

Parameters

Parameter	Type
scope	Construct
id	string
props	AccountEdgeStackProps

Returns

AccountEdgeStack

Overrides

Stack.constructor

Properties

Property	Modifier	Type	Defined in
certificate	readonly	EdgeCertificate	account-baseline-stack.ts:53

---

AccountNameLookup

Defined in: org/account-name.ts:27

Resolves the AWS Organizations account name at deploy time so environment names and domains can be derived from account names in StackSet templates, where no per-account configuration exists.

Extends

• Construct

Constructors

Constructor

new AccountNameLookup(
   scope, 
   id, 
   props?
): AccountNameLookup;

Defined in: org/account-name.ts:33

Parameters

Parameter	Type
scope	Construct
id	string
props	AccountNameLookupProps

Returns

AccountNameLookup

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Description	Defined in
accountEmail	readonly	string	Deploy-time token with the account email.	org/account-name.ts:31
accountName	readonly	string	Deploy-time token with the account name.	org/account-name.ts:29

---

AccountSettings

Defined in: modules/account-settings.ts:50

Account-wide security settings that have no CloudFormation resource type: IAM alias and password policy, S3 Block Public Access and EBS default encryption via AwsCustomResource, plus an IAM Access Analyzer.

Extends

• Construct

Constructors

Constructor

new AccountSettings(
   scope, 
   id, 
   props
): AccountSettings;

Defined in: modules/account-settings.ts:51

Parameters

Parameter	Type
scope	Construct
id	string
props	AccountSettingsProps

Returns

AccountSettings

Overrides

Construct.constructor

---

Alerting

Defined in: modules/alerting.ts:31

One SNS topic per alert severity with email subscriptions, publish permissions for CloudWatch alarms and EventBridge, and SSM parameters at /platform/env/{env}/alerts/topic-arn/{severity}. Integrations such as @rpallas/outcrop-chatops subscribe to topics.

Extends

• Construct

Constructors

Constructor

new Alerting(
   scope, 
   id, 
   props
): Alerting;

Defined in: modules/alerting.ts:34

Parameters

Parameter	Type
scope	Construct
id	string
props	AlertingProps

Returns

Alerting

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
topics	readonly	Readonly<Record<AlertSeverity, Topic>>	modules/alerting.ts:32

Methods

topic()

topic(severity): ITopic;

Defined in: modules/alerting.ts:93

Parameters

Parameter	Type
severity	"critical" | "high" | "medium" | "low"

Returns

ITopic

---

Budgets

Defined in: modules/budgets.ts:20

Monthly cost budget with actual and forecast notifications to SNS and email.

Extends

• Construct

Constructors

Constructor

new Budgets(
   scope, 
   id, 
   props
): Budgets;

Defined in: modules/budgets.ts:23

Parameters

Parameter	Type
scope	Construct
id	string
props	BudgetsProps

Returns

Budgets

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
budget	readonly	CfnBudget	modules/budgets.ts:21

---

CrossRegionParameter

Defined in: modules/dns.ts:184

Writes an SSM String parameter into another region.

Extends

• Construct

Constructors

Constructor

new CrossRegionParameter(
   scope, 
   id, 
   props
): CrossRegionParameter;

Defined in: modules/dns.ts:185

Parameters

Parameter	Type
scope	Construct
id	string
props	CrossRegionParameterProps

Returns

CrossRegionParameter

Overrides

Construct.constructor

---

Dns

Defined in: modules/dns.ts:42

Environment hosted zone, optional delegation from a parent zone (same or cross-account) and a regional wildcard certificate. Publishes /platform/env/{env}/dns/* and /platform/env/{env}/certs/regional-arn.

Certificates for CloudFront must live in us-east-1; see EdgeCertificate which AccountBaselineStack creates as a companion stack when needed.

Extends

• Construct

Constructors

Constructor

new Dns(
   scope, 
   id, 
   props
): Dns;

Defined in: modules/dns.ts:47

Parameters

Parameter	Type
scope	Construct
id	string
props	DnsProps

Returns

Dns

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
domain	readonly	string	modules/dns.ts:44
hostedZone	readonly	IHostedZone	modules/dns.ts:43
regionalCertificate?	readonly	ICertificate	modules/dns.ts:45

---

EdgeCertificate

Defined in: modules/dns.ts:140

Wildcard certificate in us-east-1 for CloudFront and publishes its ARN into the home region's SSM contract (/platform/env/{env}/certs/us-east-1-arn). Must be placed in a stack whose region is us-east-1.

Extends

• Construct

Constructors

Constructor

new EdgeCertificate(
   scope, 
   id, 
   props
): EdgeCertificate;

Defined in: modules/dns.ts:143

Parameters

Parameter	Type
scope	Construct
id	string
props	EdgeCertificateProps

Returns

EdgeCertificate

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
certificate	readonly	ICertificate	modules/dns.ts:141

---

Encryption

Defined in: modules/encryption.ts:43

The platform KMS key: symmetric, yearly rotation, alias alias/platform-<env> and a key policy that lets the platform AWS services encrypt on behalf of the account. Published to /platform/account/kms/key-arn and key-id.

Extends

• Construct

Constructors

Constructor

new Encryption(
   scope, 
   id, 
   props
): Encryption;

Defined in: modules/encryption.ts:46

Parameters

Parameter	Type
scope	Construct
id	string
props	EncryptionProps

Returns

Encryption

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
key	readonly	IKey	modules/encryption.ts:44

---

EventBusModule

Defined in: modules/event-bus.ts:25

The environment event bus platform-<env> with an archive and optional cross-account policy. Published to /platform/env/{env}/events/bus-name and bus-arn; PlatformEventRule and the runtime publishEvent use it.

Extends

• Construct

Constructors

Constructor

new EventBusModule(
   scope, 
   id, 
   props
): EventBusModule;

Defined in: modules/event-bus.ts:28

Parameters

Parameter	Type
scope	Construct
id	string
props	EventBusModuleProps

Returns

EventBusModule

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
bus	readonly	EventBus	modules/event-bus.ts:26

---

GitHubOidc

Defined in: modules/github-oidc.ts:60

GitHub Actions OIDC provider plus one least-privilege deploy role per repository (ADR 0005). Deploy roles may only assume the CDK bootstrap roles of this account/region and read CloudFormation stacks; the bootstrap roles decide what CloudFormation itself may do.

Extends

• Construct

Constructors

Constructor

new GitHubOidc(
   scope, 
   id, 
   props
): GitHubOidc;

Defined in: modules/github-oidc.ts:64

Parameters

Parameter	Type
scope	Construct
id	string
props	GitHubOidcProps

Returns

GitHubOidc

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Default value	Defined in
provider	readonly	IOidcProvider	undefined	modules/github-oidc.ts:61
roles	readonly	RepositoryRoles[]	[]	modules/github-oidc.ts:62

Methods

deployRoleFor()

deployRoleFor(owner, repo): IRole | undefined;

Defined in: modules/github-oidc.ts:212

Deploy role for a repository, if configured.

Parameters

Parameter	Type
owner	string
repo	string

Returns

IRole | undefined

---

LogRetention

Defined in: modules/log-retention.ts:59

Applies a default retention to every CloudWatch log group that has none, on a schedule and (optionally) whenever a log group is created. Publishes the value to /platform/account/log-retention-days so constructs can align with it.

Extends

• Construct

Constructors

Constructor

new LogRetention(
   scope, 
   id, 
   props
): LogRetention;

Defined in: modules/log-retention.ts:62

Parameters

Parameter	Type
scope	Construct
id	string
props	LogRetentionProps

Returns

LogRetention

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
handler	readonly	Function	modules/log-retention.ts:60

---

Network

Defined in: modules/network.ts:62

Opt-in VPC for Lambda functions that must reach private resources: private subnets (isolated by default, private-with-egress when natGateways > 0), gateway endpoints for S3 and DynamoDB, interface endpoints for the platform services, a shared Lambda security group and flow logs. Published under /platform/account/vpc/* for PlatformFunction({ vpc: true }).

Extends

• Construct

Constructors

Constructor

new Network(
   scope, 
   id, 
   props
): Network;

Defined in: modules/network.ts:66

Parameters

Parameter	Type
scope	Construct
id	string
props	NetworkProps

Returns

Network

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
lambdaSecurityGroup	readonly	SecurityGroup	modules/network.ts:64
vpc	readonly	IVpc	modules/network.ts:63

---

OrganizationsAccessRole

Defined in: org/access-role.ts:38

A role in this account that a trusted account of the organisation may assume for a narrow purpose: cross-account DNS delegation, account name lookups, StackSet administration. The trust policy is limited to one account (and optionally an external id and organisation id).

Extends

• Role

Constructors

Constructor

new OrganizationsAccessRole(
   scope, 
   id, 
   props
): OrganizationsAccessRole;

Defined in: org/access-role.ts:97

Parameters

Parameter	Type
scope	Construct
id	string
props	OrganizationsAccessRoleProps

Returns

OrganizationsAccessRole

Overrides

Role.constructor

Methods

dnsDelegation()

static dnsDelegation(
   scope, 
   id, 
   props
): OrganizationsAccessRole;

Defined in: org/access-role.ts:40

Role that lets the trusted account create NS delegation records in zone (for CrossAccountZoneDelegationRecord).

Parameters

Parameter	Type
scope	Construct
id	string
props	Omit<OrganizationsAccessRoleProps, "statements"> & object

Returns

OrganizationsAccessRole

parameterReader()

static parameterReader(
   scope, 
   id, 
   props
): OrganizationsAccessRole;

Defined in: org/access-role.ts:73

Role that lets the trusted account read this account's platform SSM parameters (cross-account lookups).

Parameters

Parameter	Type
scope	Construct
id	string
props	Omit<OrganizationsAccessRoleProps, "statements"> & object

Returns

OrganizationsAccessRole

---

PlatformStackSet

Defined in: org/stack-set.ts:61

Deploys a CDK stack to many accounts as a CloudFormation StackSet. The stack is synthesised in an isolated stage and embedded inline (or uploaded as an asset when larger than 50 KB). addDependency orders StackSets so, for example, the OIDC baseline lands before service-specific StackSets.

new PlatformStackSet(this, "Baseline", {
  stackSetName: "platform-baseline",
  template: (scope) => new BaselineTemplateStack(scope, "Template"),
  targets: { organizationalUnitIds: ["ou-example-workloads"], regions: ["eu-west-1"] },
});

Extends

• Construct

Constructors

Constructor

new PlatformStackSet(
   scope, 
   id, 
   props
): PlatformStackSet;

Defined in: org/stack-set.ts:68

Parameters

Parameter	Type
scope	Construct
id	string
props	PlatformStackSetProps

Returns

PlatformStackSet

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Description	Defined in
stackSet	readonly	CfnStackSet	-	org/stack-set.ts:62
templateSize	readonly	number	Size of the embedded template in bytes.	org/stack-set.ts:64
usesAsset	readonly	boolean	Whether the template was uploaded as an asset (templateUrl) or embedded (templateBody).	org/stack-set.ts:66

Methods

addDependency()

addDependency(other): void;

Defined in: org/stack-set.ts:150

Deploy this StackSet only after other has completed.

Parameters

Parameter	Type
other	PlatformStackSet

Returns

void

---

Security

Defined in: modules/security.ts:39

Opt-in detective controls: CloudTrail, AWS Config, GuardDuty and Security Hub. Organisation-managed variants of these services should be preferred where an AWS Organization exists; disable the corresponding flag in that case.

Extends

• Construct

Constructors

Constructor

new Security(
   scope, 
   id, 
   props
): Security;

Defined in: modules/security.ts:43

Parameters

Parameter	Type
scope	Construct
id	string
props	SecurityProps

Returns

Security

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
auditBucket?	readonly	IBucket	modules/security.ts:40
trail?	readonly	Trail	modules/security.ts:41

---

SharedParameters

Defined in: modules/shared.ts:24

Map-driven shared configuration (/platform/config/{key}) such as auth0-domain or neon-project-id. Read at synth time with params.lookup(paths.config(key)) or at runtime with getConfig(key).

Extends

• Construct

Constructors

Constructor

new SharedParameters(
   scope, 
   id, 
   props
): SharedParameters;

Defined in: modules/shared.ts:27

Parameters

Parameter	Type
scope	Construct
id	string
props	SharedParametersProps

Returns

SharedParameters

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
parameters	readonly	Readonly<Record<string, IParameter>>	modules/shared.ts:25

---

SharedSecrets

Defined in: modules/shared.ts:62

Shared Secrets Manager secrets (platform-<env>-<name>) with their ARNs published to /platform/secrets/{name}/arn. Values are generated on first deploy and are expected to be rotated or replaced outside of CloudFormation (for example aws secretsmanager put-secret-value from a CI secret), so no secret material ever appears in a template.

Extends

• Construct

Constructors

Constructor

new SharedSecrets(
   scope, 
   id, 
   props
): SharedSecrets;

Defined in: modules/shared.ts:65

Parameters

Parameter	Type
scope	Construct
id	string
props	SharedSecretsProps

Returns

SharedSecrets

Overrides

Construct.constructor

Properties

Property	Modifier	Type	Defined in
secrets	readonly	Readonly<Record<string, ISecret>>	modules/shared.ts:63

Interfaces

AccountBaselineModules

Defined in: account-baseline.ts:27

Properties

Property	Modifier	Type	Defined in
accountSettings?	readonly	ModuleOption<AccountSettingsProps>	account-baseline.ts:29
alerting?	readonly	ModuleOption<AlertingProps>	account-baseline.ts:31
budgets?	readonly	ModuleOption<BudgetsProps>	account-baseline.ts:36
dns?	readonly	ModuleOption<DnsProps>	account-baseline.ts:30
encryption?	readonly	ModuleOption<EncryptionProps>	account-baseline.ts:33
eventBus?	readonly	ModuleOption<EventBusModuleProps>	account-baseline.ts:32
githubOidc?	readonly	ModuleOption<GitHubOidcProps>	account-baseline.ts:28
logRetention?	readonly	ModuleOption<LogRetentionProps>	account-baseline.ts:39
network?	readonly	ModuleOption<NetworkProps>	account-baseline.ts:38
security?	readonly	ModuleOption<SecurityProps>	account-baseline.ts:37
sharedParameters?	readonly	ModuleProps<SharedParametersProps>	account-baseline.ts:34
sharedSecrets?	readonly	ModuleProps<SharedSecretsProps>	account-baseline.ts:35

---

AccountBaselineProps

Defined in: account-baseline.ts:42

Properties

Property	Modifier	Type	Description	Defined in
context	readonly	AccountEnvContext	-	account-baseline.ts:43
modules	readonly	AccountBaselineModules	Modules to deploy. Everything not listed is off.	account-baseline.ts:45

---

AccountBaselineStackProps

Defined in: account-baseline-stack.ts:8

Extends

• Omit<StackProps, "env" | "stackName">

Properties

Property	Modifier	Type	Description	Defined in
config	readonly	object	-	account-baseline-stack.ts:9
config.cdkQualifier	public	string	CDK bootstrap qualifier the deploy roles may assume.	config.ts:74
config.environments	public	Record<string, { account: string; alertEmails: string[]; domain?: string; github: object[]; logRetentionDays: number; monthlyBudgetUsd?: number; parentZone?: { delegationRoleArn?: string; hostedZoneId: string; zoneName: string; }; protected: boolean; region: string; }>	-	config.ts:78
config.project	public	string	Project name used for tags and naming.	config.ts:67
config.ssmRootPrefix	public	string	Root of the SSM parameter contract.	config.ts:69
config.tags	public	Record<string, string>	Additional tags applied to every resource.	config.ts:80
env?	readonly	string	Environment to deploy; defaults to -c env=<name>.	account-baseline-stack.ts:11
modules	readonly	AccountBaselineModules	-	account-baseline-stack.ts:12
stackName?	readonly	string	Override the default PlatformAccount-<env> stack name.	account-baseline-stack.ts:14

---

AccountBaselineStacks

Defined in: account-baseline-stack.ts:78

Properties

Property	Modifier	Type	Defined in
baseline	readonly	AccountBaselineStack	account-baseline-stack.ts:79
edge?	readonly	AccountEdgeStack	account-baseline-stack.ts:80

---

AccountEdgeStackProps

Defined in: account-baseline-stack.ts:41

Extends

• Omit<StackProps, "env" | "stackName">

Properties

Property	Modifier	Type	Description	Defined in
baseline	readonly	AccountBaselineStack	The baseline stack whose hosted zone the certificate validates against.	account-baseline-stack.ts:43
stackName?	readonly	string	-	account-baseline-stack.ts:44

---

AccountEnvContext

Defined in: context.ts:6

Resolved environment the baseline is being synthesised for.

Properties

Property	Modifier	Type	Description	Defined in
config	readonly	object	-	context.ts:9
config.cdkQualifier	public	string	CDK bootstrap qualifier the deploy roles may assume.	config.ts:74
config.environments	public	Record<string, { account: string; alertEmails: string[]; domain?: string; github: object[]; logRetentionDays: number; monthlyBudgetUsd?: number; parentZone?: { delegationRoleArn?: string; hostedZoneId: string; zoneName: string; }; protected: boolean; region: string; }>	-	config.ts:78
config.project	public	string	Project name used for tags and naming.	config.ts:67
config.ssmRootPrefix	public	string	Root of the SSM parameter contract.	config.ts:69
config.tags	public	Record<string, string>	Additional tags applied to every resource.	config.ts:80
env	readonly	string	-	context.ts:7
environment	readonly	object	-	context.ts:8
environment.account	public	string	-	config.ts:46
environment.alertEmails	public	string[]	Email addresses subscribed to the alert topics.	config.ts:59
environment.domain?	public	string	Environment apex domain, e.g. dev.example.com. Enables the DNS module.	config.ts:49
environment.github	public	object[]	Repositories allowed to deploy into this environment.	config.ts:57
environment.logRetentionDays	public	number	Default CloudWatch Logs retention for the account.	config.ts:55
environment.monthlyBudgetUsd?	public	number	Monthly budget in USD; enables the budgets module when set.	config.ts:61
environment.parentZone?	public	object	Delegate domain from this parent zone instead of expecting NS records to be created by hand.	config.ts:51
environment.parentZone.delegationRoleArn?	public	string	Role to assume when the parent zone lives in another account.	config.ts:41
environment.parentZone.hostedZoneId	public	string	Hosted zone id of the parent zone.	config.ts:37
environment.parentZone.zoneName	public	string	Zone name of the parent, e.g. example.com.	config.ts:39
environment.protected	public	boolean	Protected environments keep resources on stack deletion and never host previews.	config.ts:53
environment.region	public	string	-	config.ts:47
naming	readonly	PlatformNaming	Naming helper producing platform-<env>-<name> for baseline resources.	context.ts:12
paths	readonly	PlatformParameterPaths	-	context.ts:10

---

AccountNameDomainOptions

Defined in: org/account-name.ts:70

Properties

Property	Modifier	Type	Description	Defined in
apexDomain	readonly	string	Apex domain, e.g. example.com.	org/account-name.ts:72
apexNames?	readonly	string[]	Account names (after prefix removal) that map to the apex itself. Default ["prod", "production"].	org/account-name.ts:76
workloadPrefix?	readonly	string	Prefix shared by all workload accounts that is stripped, e.g. my-platform- from my-platform-dev.	org/account-name.ts:74

---

AccountNameLookupProps

Defined in: org/account-name.ts:10

Properties

Property	Modifier	Type	Description	Defined in
accountId?	readonly	string	Account to describe. Defaults to the current account.	org/account-name.ts:12
assumeRoleArn?	readonly	string	Role in the management or delegated administrator account that may call organizations:DescribeAccount (see OrganizationsAccessRole). Without it the call is made with the deploying credentials, which works only from the management account.	org/account-name.ts:19

---

AccountSettingsProps

Defined in: modules/account-settings.ts:22

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
accessAnalyzer?	readonly	boolean	IAM Access Analyzer for the account. Default true.	-	modules/account-settings.ts:32
alias?	readonly	string | false	IAM account alias, e.g. my-platform-dev. Defaults to <project>-<env>; false skips it.	-	modules/account-settings.ts:24
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
ebsEncryptionByDefault?	readonly	boolean	EBS encryption by default in this region. Default true.	-	modules/account-settings.ts:30
passwordPolicy?	readonly	false | PasswordPolicy	IAM password policy; false leaves the account policy untouched.	-	modules/account-settings.ts:26
s3BlockPublicAccess?	readonly	boolean	Account-level S3 Block Public Access. Default true.	-	modules/account-settings.ts:28

---

AlertingProps

Defined in: modules/alerting.ts:16

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
allowOrganizationId?	readonly	string	Allow the whole organisation to publish to the topics (cross-account alarms).	-	modules/alerting.ts:22
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
emails?	readonly	Partial<Record<"critical" | "high" | "medium" | "low", string[]>>	Email subscriptions per severity. Defaults to environment.alertEmails for every severity.	-	modules/alerting.ts:18
kmsKey?	readonly	IKey	Encrypt topics with this key (typically Encryption.key).	-	modules/alerting.ts:20

---

BaselineModuleProps

Defined in: modules/base.ts:7

Props shared by every baseline module.

Extended by

• GitHubOidcProps
• AccountSettingsProps
• DnsProps
• AlertingProps
• EventBusModuleProps
• EncryptionProps
• SharedParametersProps
• SharedSecretsProps
• BudgetsProps
• SecurityProps
• NetworkProps
• LogRetentionProps

Properties

Property	Modifier	Type	Defined in
context	readonly	AccountEnvContext	modules/base.ts:8

---

BudgetsProps

Defined in: modules/budgets.ts:6

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
actualThresholds?	readonly	number[]	Actual-spend thresholds (percent) that trigger a notification. Default [80, 100].	-	modules/budgets.ts:10
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
emails?	readonly	string[]	Email addresses to notify. Defaults to environment.alertEmails.	-	modules/budgets.ts:16
forecastThresholds?	readonly	number[]	Forecasted-spend thresholds (percent). Default [100].	-	modules/budgets.ts:12
monthlyUsd?	readonly	number	Monthly cost budget in USD. Defaults to environment.monthlyBudgetUsd.	-	modules/budgets.ts:8
topic?	readonly	ITopic	SNS topic to notify (e.g. alerting.topic("high")).	-	modules/budgets.ts:14

---

CrossRegionParameterProps

Defined in: modules/dns.ts:177

Properties

Property	Modifier	Type	Defined in
name	readonly	string	modules/dns.ts:179
region	readonly	string	modules/dns.ts:178
value	readonly	string	modules/dns.ts:180

---

DnsProps

Defined in: modules/dns.ts:23

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
additionalNames?	readonly	string[]	Extra subject alternative names for the regional certificate.	-	modules/dns.ts:31
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
domain?	readonly	string	Environment domain. Defaults to environment.domain from the config.	-	modules/dns.ts:25
existingHostedZoneId?	readonly	string	Import an existing hosted zone instead of creating one.	-	modules/dns.ts:27
regionalCertificate?	readonly	boolean	Issue a wildcard + apex certificate in the stack region. Default true.	-	modules/dns.ts:29

---

EdgeCertificateProps

Defined in: modules/dns.ts:126

Properties

Property	Modifier	Type	Description	Defined in
context	readonly	AccountEnvContext	-	modules/dns.ts:127
domain	readonly	string	-	modules/dns.ts:130
homeRegion	readonly	string	Region that hosts the SSM contract; the certificate ARN is written there.	modules/dns.ts:132
hostedZoneId	readonly	string	Hosted zone id of the environment zone (deployed by Dns in the home region).	modules/dns.ts:129

---

EncryptionProps

Defined in: modules/encryption.ts:15

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
allowedPrincipalArns?	readonly	string[]	Additional principal ARNs allowed to use the key.	-	modules/encryption.ts:19
allowOrganizationId?	readonly	string	Allow every principal in this AWS Organization to use the key (for cross-account SNS/SQS/S3).	-	modules/encryption.ts:17
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
servicePrincipals?	readonly	string[]	AWS services allowed to use the key via grants. Default: logs, sns, sqs, s3, secretsmanager, ssm, events, lambda, dynamodb, states, scheduler.	-	modules/encryption.ts:21

---

EventBusModuleProps

Defined in: modules/event-bus.ts:9

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
allowAccountIds?	readonly	string[]	Additional account ids allowed to PutEvents.	-	modules/event-bus.ts:15
allowOrganizationId?	readonly	string	Allow every account in the organisation to PutEvents on the bus.	-	modules/event-bus.ts:13
archiveRetention?	readonly	false | Duration	Archive every event for replay. Default 30 days; false disables the archive.	-	modules/event-bus.ts:11
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
logAllEvents?	readonly	boolean	Mirror all events into a CloudWatch log group (handy in dev, noisy in prod). Default false.	-	modules/event-bus.ts:17

---

GitHubOidcProps

Defined in: modules/github-oidc.ts:35

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
additionalDeployStatements?	readonly	PolicyStatement[]	Additional statements granted to every deploy role, for the rare case CDK bootstrap roles are not enough.	-	modules/github-oidc.ts:41
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
existingProviderArn?	readonly	string	Import an existing provider instead of creating one (there can be only one per account).	-	modules/github-oidc.ts:37
maxSessionDuration?	readonly	Duration	Maximum session duration for deploy roles. Default 1 hour.	-	modules/github-oidc.ts:45
permissionsBoundary?	readonly	ManagedPolicy	Permissions boundary applied to every role created here.	-	modules/github-oidc.ts:43
repositories?	readonly	object[]	Repositories allowed to deploy. Defaults to environment.github from the config.	-	modules/github-oidc.ts:39

---

LogRetentionProps

Defined in: modules/log-retention.ts:16

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
excludePrefixes?	readonly	string[]	Log group name prefixes to leave alone.	-	modules/log-retention.ts:24
onCreateLogGroup?	readonly	boolean	Also react to CreateLogGroup API calls (requires CloudTrail management events). Default true.	-	modules/log-retention.ts:22
retentionDays?	readonly	number	Retention applied to log groups that have none. Defaults to environment.logRetentionDays.	-	modules/log-retention.ts:18
sweepInterval?	readonly	Duration	How often to sweep for log groups without retention. Default every hour.	-	modules/log-retention.ts:20

---

NetworkProps

Defined in: modules/network.ts:25

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
cidr?	readonly	string	VPC CIDR. Default 10.0.0.0/16.	-	modules/network.ts:27
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
flowLogs?	readonly	boolean	Flow logs to CloudWatch Logs. Default true.	-	modules/network.ts:39
interfaceEndpoints?	readonly	InterfaceVpcEndpointAwsService[]	Interface endpoints to create. Defaults to the services the platform uses.	-	modules/network.ts:37
maxAzs?	readonly	number	Number of availability zones. Default 2.	-	modules/network.ts:29
natGateways?	readonly	number	NAT gateways for private subnets. Default 0: Lambda functions reach AWS services through VPC endpoints and have no internet access, which is the cheapest and safest default. Set to 1 or more when functions call the internet.	-	modules/network.ts:35

---

OrganizationsAccessRoleProps

Defined in: org/access-role.ts:16

Properties

Property	Modifier	Type	Description	Defined in
description?	readonly	string	-	org/access-role.ts:21
externalId?	readonly	string	Require sts:ExternalId when assuming.	org/access-role.ts:26
managedPolicies?	readonly	ManagedPolicy[]	-	org/access-role.ts:24
maxSessionDuration?	readonly	Duration	-	org/access-role.ts:29
organizationId?	readonly	string	Restrict the trust to principals in this organisation.	org/access-role.ts:28
roleName	readonly	string	Fixed role name so other accounts can build the ARN without lookups.	org/access-role.ts:20
statements	readonly	PolicyStatement[]	Statements the role is granted.	org/access-role.ts:23
trustedAccountId	readonly	string	Account allowed to assume the role (management, delegated administrator or a shared-services account).	org/access-role.ts:18

---

PasswordPolicy

Defined in: modules/account-settings.ts:12

Properties

Property	Modifier	Type	Defined in
maxAgeDays?	readonly	number	modules/account-settings.ts:18
minimumLength?	readonly	number	modules/account-settings.ts:13
requireLowercase?	readonly	boolean	modules/account-settings.ts:17
requireNumbers?	readonly	boolean	modules/account-settings.ts:15
requireSymbols?	readonly	boolean	modules/account-settings.ts:14
requireUppercase?	readonly	boolean	modules/account-settings.ts:16
reusePrevention?	readonly	number	modules/account-settings.ts:19

---

PlatformStackSetProps

Defined in: org/stack-set.ts:18

Properties

Property	Modifier	Type	Description	Defined in
administrationRoleArn?	readonly	string	SELF_MANAGED only: administration role ARN and execution role name.	org/stack-set.ts:41
autoDeployment?	readonly	boolean	Automatically deploy to accounts added to the target OUs. Default true for SERVICE_MANAGED.	org/stack-set.ts:32
capabilities?	readonly	string[]	-	org/stack-set.ts:38
delegatedAdmin?	readonly	boolean	Call as a delegated administrator instead of the management account. Default true.	org/stack-set.ts:36
description?	readonly	string	-	org/stack-set.ts:21
executionRoleName?	readonly	string	-	org/stack-set.ts:42
operationPreferences?	readonly	OperationPreferencesProperty	-	org/stack-set.ts:39
parameters?	readonly	Record<string, string>	-	org/stack-set.ts:37
permissionModel?	readonly	"SERVICE_MANAGED" | "SELF_MANAGED"	SERVICE_MANAGED deploys from the management/delegated administrator account. Default SERVICE_MANAGED.	org/stack-set.ts:30
retainStacksOnAccountRemoval?	readonly	boolean	Retain stacks when an account leaves the OU. Default false.	org/stack-set.ts:34
stackSetName	readonly	string	Name of the StackSet.	org/stack-set.ts:20
tags?	readonly	Record<string, string>	Extra tags applied to every stack instance.	org/stack-set.ts:44
targets	readonly	StackSetTargets	-	org/stack-set.ts:28
template	readonly	(scope) => Stack	Builds the stack to deploy in every target. It is synthesised into an isolated Stage so its template can be embedded; the stack must be environment-agnostic and asset-free (inline Lambda code only) unless every target account has the CDK asset bucket.	org/stack-set.ts:27

---

RepositoryRoles

Defined in: modules/github-oidc.ts:48

Properties

Property	Modifier	Type	Description	Defined in
deployRole	readonly	Role	-	modules/github-oidc.ts:50
readOnlyRole?	readonly	Role	-	modules/github-oidc.ts:51
repository	readonly	object	-	modules/github-oidc.ts:49
repository.allowPullRequests	public	boolean	Allow pull_request workflows (preview stacks) to assume the deploy role. Default true.	config.ts:19
repository.branches	public	string[]	Additional branches (besides GitHub environments) allowed to assume the deploy role.	config.ts:21
repository.githubEnvironments?	public	string[]	GitHub environment names that map to this AWS environment. Defaults to the AWS environment name.	config.ts:23
repository.owner	public	string	-	config.ts:9
repository.ownerId?	public	number	Numeric owner and repository ids. Set both when the repository uses GitHub's immutable OIDC subject format (repo:owner@<ownerId>/repo@<repoId>:...), the default for repositories created after 15 July 2026. outcrop oidc-subject <owner>/<repo> prints them.	config.ts:16
repository.readOnlyRole	public	boolean	Also create a read-only role for cdk diff on pull requests. Default true.	config.ts:25
repository.repo	public	string	-	config.ts:10
repository.repoId?	public	number	-	config.ts:17

---

SecurityProps

Defined in: modules/security.ts:20

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
auditRetention?	readonly	Duration	Retention for the audit bucket objects. Default 365 days (protected environments: 7 years).	-	modules/security.ts:30
cloudTrail?	readonly	boolean	Multi-region CloudTrail for management events with CloudWatch Logs delivery. Default true.	-	modules/security.ts:22
config?	readonly	boolean	AWS Config recorder for all supported resource types. Default true.	-	modules/security.ts:24
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
guardDuty?	readonly	boolean	GuardDuty detector. Default true. Skip when GuardDuty is managed by the organisation.	-	modules/security.ts:26
kmsKey?	readonly	IKey	-	-	modules/security.ts:31
securityHub?	readonly	boolean	Security Hub with the AWS Foundational Security Best Practices standard. Default true.	-	modules/security.ts:28

---

SharedParametersProps

Defined in: modules/shared.ts:14

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Description	Inherited from	Defined in
context	readonly	AccountEnvContext	-	BaselineModuleProps.context	modules/base.ts:8
values	readonly	Record<string, string | string[]>	Plain configuration values published under /platform/config/{key}.	-	modules/shared.ts:16

---

SharedSecretSpec

Defined in: modules/shared.ts:42

Properties

Property	Modifier	Type	Description	Defined in
description?	readonly	string	-	modules/shared.ts:43
existingArn?	readonly	string	Publish an existing secret (by complete ARN) instead of creating one.	modules/shared.ts:47
generate?	readonly	| false | { excludePunctuation?: boolean; length?: number; }	Generate a random value (default). The value can be overwritten out of band with put-secret-value.	modules/shared.ts:45

---

SharedSecretsProps

Defined in: modules/shared.ts:50

Props shared by every baseline module.

Extends

• BaselineModuleProps

Properties

Property	Modifier	Type	Inherited from	Defined in
context	readonly	AccountEnvContext	BaselineModuleProps.context	modules/base.ts:8
kmsKey?	readonly	IKey	-	modules/shared.ts:52
secrets	readonly	Record<string, SharedSecretSpec>	-	modules/shared.ts:51

---

StackSetTargets

Defined in: org/stack-set.ts:9

Properties

Property	Modifier	Type	Description	Defined in
accounts?	readonly	string[]	Explicit account ids; required for SELF_MANAGED, optional filter for SERVICE_MANAGED.	org/stack-set.ts:13
organizationalUnitIds?	readonly	string[]	Organizational unit ids (ou-example-...) or the root id (r-...); SERVICE_MANAGED only.	org/stack-set.ts:11
regions?	readonly	string[]	Regions to deploy each instance into. Defaults to the region of the enclosing stack.	org/stack-set.ts:15

Type Aliases

AccountConfig

type AccountConfig = z.output<typeof AccountConfigSchema>;

Defined in: config.ts:82

---

AccountConfigInput

type AccountConfigInput = z.input<typeof AccountConfigSchema>;

Defined in: config.ts:83

---

AccountEnvironment

type AccountEnvironment = z.output<typeof AccountEnvironmentSchema>;

Defined in: config.ts:63

---

GitHubRepository

type GitHubRepository = z.output<typeof GitHubRepositorySchema>;

Defined in: config.ts:31

---

GitHubRepositoryInput

type GitHubRepositoryInput = z.input<typeof GitHubRepositorySchema>;

Defined in: config.ts:32

---

ParentZone

type ParentZone = z.output<typeof ParentZoneSchema>;

Defined in: config.ts:43

Variables

AccountConfigSchema

const AccountConfigSchema: ZodObject<{
  cdkQualifier: ZodDefault<ZodString>;
  environments: ZodRecord<ZodString, ZodObject<{
     account: ZodString;
     alertEmails: ZodDefault<ZodArray<ZodEmail>>;
     domain: ZodOptional<ZodString>;
     github: ZodDefault<ZodArray<ZodObject<{
        allowPullRequests: ZodDefault<ZodBoolean>;
        branches: ZodDefault<ZodArray<...>>;
        githubEnvironments: ZodOptional<ZodArray<...>>;
        owner: ZodString;
        ownerId: ZodOptional<ZodNumber>;
        readOnlyRole: ZodDefault<ZodBoolean>;
        repo: ZodString;
        repoId: ZodOptional<ZodNumber>;
     }, $strip>>>;
     logRetentionDays: ZodDefault<ZodNumber>;
     monthlyBudgetUsd: ZodOptional<ZodNumber>;
     parentZone: ZodOptional<ZodObject<{
        delegationRoleArn: ZodOptional<ZodString>;
        hostedZoneId: ZodString;
        zoneName: ZodString;
     }, $strip>>;
     protected: ZodDefault<ZodBoolean>;
     region: ZodString;
  }, $strip>>;
  project: ZodString;
  ssmRootPrefix: ZodDefault<ZodString>;
  tags: ZodDefault<ZodRecord<ZodString, ZodString>>;
}, $strip>;

Defined in: config.ts:65

---

AccountEnvironmentSchema

const AccountEnvironmentSchema: ZodObject<{
  account: ZodString;
  alertEmails: ZodDefault<ZodArray<ZodEmail>>;
  domain: ZodOptional<ZodString>;
  github: ZodDefault<ZodArray<ZodObject<{
     allowPullRequests: ZodDefault<ZodBoolean>;
     branches: ZodDefault<ZodArray<ZodString>>;
     githubEnvironments: ZodOptional<ZodArray<ZodString>>;
     owner: ZodString;
     ownerId: ZodOptional<ZodNumber>;
     readOnlyRole: ZodDefault<ZodBoolean>;
     repo: ZodString;
     repoId: ZodOptional<ZodNumber>;
  }, $strip>>>;
  logRetentionDays: ZodDefault<ZodNumber>;
  monthlyBudgetUsd: ZodOptional<ZodNumber>;
  parentZone: ZodOptional<ZodObject<{
     delegationRoleArn: ZodOptional<ZodString>;
     hostedZoneId: ZodString;
     zoneName: ZodString;
  }, $strip>>;
  protected: ZodDefault<ZodBoolean>;
  region: ZodString;
}, $strip>;

Defined in: config.ts:45

---

DEFAULT_INTERFACE_ENDPOINTS

const DEFAULT_INTERFACE_ENDPOINTS: InterfaceVpcEndpointAwsService[];

Defined in: modules/network.ts:42

---

GITHUB_OIDC_AUDIENCE

const GITHUB_OIDC_AUDIENCE: "sts.amazonaws.com" = "sts.amazonaws.com";

Defined in: modules/github-oidc.ts:19

---

GITHUB_OIDC_URL

const GITHUB_OIDC_URL: "https://token.actions.githubusercontent.com" = "https://token.actions.githubusercontent.com";

Defined in: modules/github-oidc.ts:18

---

GitHubRepositorySchema

const GitHubRepositorySchema: ZodObject<{
  allowPullRequests: ZodDefault<ZodBoolean>;
  branches: ZodDefault<ZodArray<ZodString>>;
  githubEnvironments: ZodOptional<ZodArray<ZodString>>;
  owner: ZodString;
  ownerId: ZodOptional<ZodNumber>;
  readOnlyRole: ZodDefault<ZodBoolean>;
  repo: ZodString;
  repoId: ZodOptional<ZodNumber>;
}, $strip>;

Defined in: config.ts:7

A GitHub repository allowed to deploy into an environment.

---

ParentZoneSchema

const ParentZoneSchema: ZodObject<{
  delegationRoleArn: ZodOptional<ZodString>;
  hostedZoneId: ZodString;
  zoneName: ZodString;
}, $strip>;

Defined in: config.ts:35

Delegate the environment domain from a parent hosted zone (same or another account).

---

STACK_SET_INLINE_TEMPLATE_LIMIT

const STACK_SET_INLINE_TEMPLATE_LIMIT: 51200 = 51_200;

Defined in: org/stack-set.ts:7

Inline template bodies are limited to 51,200 bytes; larger templates are uploaded as assets.

Functions

baselineRemovalPolicy()

function baselineRemovalPolicy(context): RemovalPolicy;

Defined in: modules/base.ts:12

Removal policy for account-level resources: protected environments retain everything.

Parameters

Parameter	Type
context	AccountEnvContext

Returns

RemovalPolicy

---

createAccountBaseline()

function createAccountBaseline(app, props): AccountBaselineStacks;

Defined in: account-baseline-stack.ts:87

Creates the baseline stack for the selected environment and, when DNS is enabled outside us-east-1, the edge certificate stack alongside it.

Parameters

Parameter	Type
app	App
props	AccountBaselineStackProps

Returns

AccountBaselineStacks

---

defineAccountConfig()

function defineAccountConfig(input): object;

Defined in: config.ts:100

Validates and normalises an account baseline configuration.

export default defineAccountConfig({
  project: "my-platform",
  environments: {
    dev: { account: "111111111111", region: "eu-west-1", domain: "dev.example.com",
           github: [{ owner: "my-org", repo: "orders" }] },
    prod: { account: "222222222222", region: "eu-west-1", domain: "example.com", protected: true,
            github: [{ owner: "my-org", repo: "orders", allowPullRequests: false }] },
  },
});

Parameters

Parameter	Type	Description
input	{ cdkQualifier?: string; environments: Record<string, { account: string; alertEmails?: string[]; domain?: string; github?: object[]; logRetentionDays?: number; monthlyBudgetUsd?: number; parentZone?: { delegationRoleArn?: string; hostedZoneId: string; zoneName: string; }; protected?: boolean; region: string; }>; project: string; ssmRootPrefix?: string; tags?: Record<string, string>; }	-
input.cdkQualifier?	string	CDK bootstrap qualifier the deploy roles may assume.
input.environments	Record<string, { account: string; alertEmails?: string[]; domain?: string; github?: object[]; logRetentionDays?: number; monthlyBudgetUsd?: number; parentZone?: { delegationRoleArn?: string; hostedZoneId: string; zoneName: string; }; protected?: boolean; region: string; }>	-
input.project	string	Project name used for tags and naming.
input.ssmRootPrefix?	string	Root of the SSM parameter contract.
input.tags?	Record<string, string>	Additional tags applied to every resource.

Returns

Name	Type	Description	Defined in
cdkQualifier	string	CDK bootstrap qualifier the deploy roles may assume.	config.ts:74
environments	Record<string, { account: string; alertEmails: string[]; domain?: string; github: object[]; logRetentionDays: number; monthlyBudgetUsd?: number; parentZone?: { delegationRoleArn?: string; hostedZoneId: string; zoneName: string; }; protected: boolean; region: string; }>	-	config.ts:78
project	string	Project name used for tags and naming.	config.ts:67
ssmRootPrefix	string	Root of the SSM parameter contract.	config.ts:69
tags	Record<string, string>	Additional tags applied to every resource.	config.ts:80

---

environmentFromAccountName()

function environmentFromAccountName(accountName, options): object;

Defined in: org/account-name.ts:85

Derives an environment name and domain from an account name, the convention used when accounts are created per environment: my-platform-dev -> { env: "dev", domain: "dev.example.com" }, my-platform-prod -> { env: "prod", domain: "example.com" }.

Parameters

Parameter	Type
accountName	string
options	AccountNameDomainOptions

Returns

object

Name	Type	Defined in
domain	string	org/account-name.ts:88
env	string	org/account-name.ts:88

---

oidcSubjectPrefix()

function oidcSubjectPrefix(repository): string;

Defined in: modules/github-oidc.ts:26

The repo: prefix of the OIDC sub claim for a repository. With ids this is GitHub's immutable format (repo:owner@123/repo@456), which only that repository can mint, even after the name is reused; without ids it is the name-based format used by repositories created before July 2026.

Parameters

Parameter	Type	Description
repository	{ allowPullRequests: boolean; branches: string[]; githubEnvironments?: string[]; owner: string; ownerId?: number; readOnlyRole: boolean; repo: string; repoId?: number; }	-
repository.allowPullRequests	boolean	Allow pull_request workflows (preview stacks) to assume the deploy role. Default true.
repository.branches	string[]	Additional branches (besides GitHub environments) allowed to assume the deploy role.
repository.githubEnvironments?	string[]	GitHub environment names that map to this AWS environment. Defaults to the AWS environment name.
repository.owner	string	-
repository.ownerId?	number	Numeric owner and repository ids. Set both when the repository uses GitHub's immutable OIDC subject format (repo:owner@<ownerId>/repo@<repoId>:...), the default for repositories created after 15 July 2026. outcrop oidc-subject <owner>/<repo> prints them.
repository.readOnlyRole	boolean	Also create a read-only role for cdk diff on pull requests. Default true.
repository.repo	string	-
repository.repoId?	number	-

Returns

string

---

output()

function output(
   scope, 
   id, 
   value, 
   description?
): CfnOutput;

Defined in: modules/base.ts:44

Adds a stack output with a stable export name derived from the environment.

Parameters

Parameter	Type
scope	Construct
id	string
value	string
description?	string

Returns

CfnOutput

---

pascal()

function pascal(value): string;

Defined in: modules/base.ts:64

orders-api -> OrdersApi for construct ids and outputs.

Parameters

Parameter	Type
value	string

Returns

string

---

publishListParameter()

function publishListParameter(
   scope, 
   id, 
   parameterName, 
   values
): StringListParameter;

Defined in: modules/base.ts:31

Writes a StringList parameter.

Parameters

Parameter	Type
scope	Construct
id	string
parameterName	string
values	string[]

Returns

StringListParameter

---

publishParameter()

function publishParameter(
   scope, 
   id, 
   parameterName, 
   stringValue, 
   description?
): StringParameter;

Defined in: modules/base.ts:16

Writes a value to the SSM contract and returns the parameter.

Parameters

Parameter	Type
scope	Construct
id	string
parameterName	string
stringValue	string
description?	string

Returns

StringParameter

---

repoSlug()

function repoSlug(owner, repo): string;

Defined in: modules/base.ts:57

my-org/orders -> my-org-orders, safe for IAM role names and SSM path segments.

Parameters

Parameter	Type
owner	string
repo	string

Returns

string

---

resolveAccountEnv()

function resolveAccountEnv(
   scope, 
   config, 
   explicitEnv?
): AccountEnvContext;

Defined in: context.ts:19

Reads -c env=<name> (or PLATFORM_ENV) and returns the matching environment. Baseline stacks are account-level, so there is no preview mode.

Parameters

Parameter	Type	Description
scope	Construct	-
config	{ cdkQualifier: string; environments: Record<string, { account: string; alertEmails: string[]; domain?: string; github: object[]; logRetentionDays: number; monthlyBudgetUsd?: number; parentZone?: { delegationRoleArn?: string; hostedZoneId: string; zoneName: string; }; protected: boolean; region: string; }>; project: string; ssmRootPrefix: string; tags: Record<string, string>; }	-
config.cdkQualifier	string	CDK bootstrap qualifier the deploy roles may assume.
config.environments?	Record<string, { account: string; alertEmails: string[]; domain?: string; github: object[]; logRetentionDays: number; monthlyBudgetUsd?: number; parentZone?: { delegationRoleArn?: string; hostedZoneId: string; zoneName: string; }; protected: boolean; region: string; }>	-
config.project?	string	Project name used for tags and naming.
config.ssmRootPrefix?	string	Root of the SSM parameter contract.
config.tags?	Record<string, string>	Additional tags applied to every resource.
explicitEnv?	string	-

Returns

AccountEnvContext