A monthly summary of what shipped to customer landing zones: new guardrails, account baselines, and fixes across the foundation, constructs, and core packages.
380 commits shipped to the AWS CDK Landing Zone in the past year
cdk-landing-zone-foundation
v1.10.0CI deployments now trust immutable GitHub repository and environment IDs instead of renameable names. Renaming a repository, or someone claiming an old repository name, can no longer inherit deploy access to your AWS accounts.
New
The GitHub OIDC deploy role pins repository and environment IDs that survive renames, so the trust policy keeps pointing at the repository you actually approved.
New
You configure the repository by name and the foundation resolves the underlying IDs at synthesis time, with lookups that stay safe to run in CI.
Improved
The deploy role now expects the landingzone GitHub environment by default, which makes environment protection rules part of the trust boundary instead of an optional extra.
Fixed
Synthesis jobs no longer receive repository tokens, keeping credentials out of the part of the pipeline that only needs to produce templates.
Landing Zone Core
Deployment plumbing moved out of the management account, baseline coverage expanded to every active Region, and retiring an AWS account is now an automated flow instead of a manual checklist.
New
StackSets now roll out from a dedicated landing zone account rather than the management account, shrinking what your CI pipeline can touch in the most privileged account of the organization.
New
A dedicated organizational unit plus scheduled reconciliation retires accounts safely: move an account there and the landing zone handles the close process.
New
CDK bootstrap, service quota, and organization security StackSets now deploy to all Regions you mark active in the settings, not just the primary one.
Improved
The account baseline StackSet is now called AccountSecurityStackSet and the organization trail StackSet became OrganizationSecurityStackSet, matching what each one actually deploys.
cdk-landing-zone-foundation
v1.4.0 – v1.9.2Registering a security service as delegated administrator now takes one line, deployment assets moved out of the management account, and StackSet rollouts gained the tuning options you would expect from the console.
New
The foundation ships a registry of per-service registration strategies, so delegating administration for a new AWS service no longer requires writing custom resource plumbing.
New
Root credentials for member accounts are centrally managed, removing per-account root access as an attack surface across the organization.
New
Landing zone asset buckets are provisioned in the delegated admin account with cleanup handled on deletion, keeping deployment artifacts out of the management account.
Improved
Deployment options now use console-aligned names for concurrency and failure tolerance, and quota guards warn before you hit CloudFormation output, parameter, or SCP limits.
Fixed
Delegated admin deregistration, trusted access removal, and policy type teardown now happen in a safe order, so removing a service no longer strands organization resources.
cdk-landing-zone-constructs
v1.5.0 – v1.10.3Per-account CloudTrail became a single delegated-admin organization trail with KMS encryption and ready-made Athena querying, alongside new IAM guardrails and a far more resilient enable and teardown story for the security services.
New
One KMS-encrypted organization trail replaces per-account trails, with a Glue database, Athena workgroup, and CIS CloudWatch alarms ready for the security team on day one.
New
A new IamAccessAnalyzerConstruct finds unintended external access, and public EBS snapshot sharing is blocked organization-wide by default.
Improved
Pass your own list of disabled control IDs when a specific control does not fit how your organization works, instead of accepting the full default set.
Fixed
GuardDuty, Macie, and Inspector now adopt pre-existing states, wait for policy convergence, retry transient errors, and tolerate Region-deny guardrails, so both first deployments and teardowns finish cleanly.
Landing Zone Core
The core landing zone app went live: a CDK application that builds your AWS organization, provisions accounts with secure defaults, and rolls out security baselines as StackSets from your own GitHub repository.
New
Organizational units, accounts, and their defaults live in one typed settings file; the app reconciles the organization on every deploy and new accounts are ready in minutes.
New
CloudTrail, GuardDuty, AWS Config, cost controls, and secure account defaults roll out to every account automatically, including accounts you create later.
New
Region and tag-protection guardrails ship enabled, tuned so legitimate global services keep working instead of tripping over the deny rules.
cdk-landing-zone-foundation
v1.0.0 – v1.3.2The first releases of the foundation package cover what a landing zone needs before workloads arrive: AWS Organizations management, GitHub OIDC deployments without stored credentials, and the StackSet prerequisites everything else builds on.
New
A GitHub OIDC role trusts your repository directly, and additional repositories can be granted deploy access when more teams need to ship infrastructure.
New
Service-managed StackSet execution role patterns and automatic permission-model inference remove the manual IAM setup that usually precedes a StackSet rollout.
Improved
The foundation pins explicit CDK feature flags and strong cross-stack references, so CDK upgrades change behavior when you decide, not when a default flips.
Fixed
StackSet asset keys are aligned with their uploads, ending the intermittent missing-asset failures that could interrupt a first deployment.
cdk-landing-zone-constructs
v1.0.0 – v1.4.2The constructs library launched with the full security baseline: Security Hub, GuardDuty, Macie, Inspector, and hardened account defaults, each enabled across the organization through delegated administration.
New
AWS Foundational Security Best Practices and the CIS AWS Foundations Benchmark v5.0.0 apply organization-wide, with account associations and finding aggregation managed for you.
New
GuardDuty auto-enables its organization protection plans for every member account, and Macie ships with automated sensitive data discovery included.
New
New accounts automatically request the quota increases the baseline needs, with idempotent handling so re-deploys never file duplicate requests.
Fixed
Alternate contacts and marketing mail preferences are reconciled on every deploy, so security and billing notifications reach the right people in every account.
New to the product? Start with the AWS CDK Landing Zone service page, browse the documentation to see everything it deploys, or check the roadmap to see what is coming next. Looking for hands-on help instead? Explore our AWS Professional Services. Questions about a release? Get in touch.