AWS Starter Kit
Free for teams of 3 or fewer

One config file.
Complete AWS multi-account setup.

Securely automate AWS Organizations with Terraform + GitHub Actions. One config file, one command — production-ready infrastructure.

terminal

# 1. Edit config

$ vim starter-kit.conf

PROJECT_NAME="my-company"

AWS_REGION="ap-northeast-1"

GITHUB_ORG="my-org"

# 2. Run setup

$ bash setup.sh

✓ S3 backend created

✓ DynamoDB table created

✓ Secrets Manager initialized

✓ Terraform initialized

# 3. Push & deploy

$ git push origin main

→ GitHub Actions: terraform apply

✓ AWS Organizations configured

✓ Ready to create projects!

Sound familiar?

Common problems teams face when adopting AWS. Manual management doesn't scale.

Manual account management leads to errors

Click-ops in the console. No audit trail. Missed settings cause production incidents.

Secrets accidentally committed to Git

AWS access keys in .env files, accidentally pushed. A story as old as Git itself.

Inconsistent dev / stg / prd environments

Hand-built environments differ subtly. "It worked in staging..."

Direct IAM permissions are a security risk

Users with direct AdministratorAccess. Manual revocation on offboarding.

Long-lived access keys for CI/CD

Access keys stored in GitHub Secrets. When was the last rotation? What if they leak?

What AWS Starter Kit Does

Enterprise-grade multi-account management, accessible to startups.

ReadOnly User Auto-Provisioning

New users created with secure defaults. MFA required, forced password reset.

AWS Organizations Management

OU structure, account creation, and automatic role distribution via StackSets — all as code.

create project → dev/stg/prd

Enter a project name in GitHub Actions. Three environments created automatically.

Feature Branch Environments

Push a branch, get an environment. Merge it, it's gone. Vercel-like experience on AWS.

Switch Role Security

No direct permissions on management account. Access member accounts only via Switch Role.

MFA Enforcement

Console and API locked until MFA is configured. Security baseline guaranteed.

GitHub Actions OIDC

No access keys. OIDC federation provides temporary credentials automatically.

One Config File

Edit starter-kit.conf, run setup.sh. That's it — your environment is ready.

Why Switch Role?

Cross-account access based on AWS best practices

Switch Role is the core security pattern for multi-account operations recommended by AWS. Compared to granting direct permissions to users, it provides dramatically better security and manageability.

How it works

IAM users in the management account have no direct operational permissions. They can only operate by switching to DeveloperRole or ReadRole in member accounts.

IAM User (Management Account)
│ no direct permissions
↓ Switch Role ↓
DeveloperRole
ReadRole
│
dev account
stg account
prd account

Benefits

  • Naturally enforces the principle of least privilege
  • Complete audit trail via CloudTrail — who accessed what, when
  • On offboarding, just delete the IAM user — all access revoked instantly
  • External users (contractors) get per-project, per-environment access control
Direct Permissions
Switch Role
Permission management
Configured per account
Centrally managed
Offboarding
Manual removal from all accounts
Delete IAM user only
Audit
Difficult across accounts
Complete via CloudTrail
Security
Tends toward over-permissioning
Least privilege by default

Architecture

Hierarchical multi-account structure via AWS Organizations

Management Account (Central Control)
├── IAM Users (MFA Required)
│   ├── developers group → DeveloperRole (all projects)
│   └── readers group    → ReadRole (all projects)
│
├── GitHub Actions OIDC Provider
│   └── Temporary credentials (no access keys)
│
├── Secrets Manager
│   └── /terraform/config (single source of truth)
│
└── Organizations
    └── projects OU
        ├── dev OU
        │   ├── dev-project-a  ← feature branches OK
        │   └── dev-project-b
        │
        ├── stg OU
        │   ├── stg-project-a  ← develop branch only
        │   └── stg-project-b
        │
        └── prd OU
            ├── prd-project-a  ← main branch only
            └── prd-project-b

Get started in 3 steps

Production-ready AWS environment in 5 minutes.

01

Edit the config file

Enter your project name and AWS region in starter-kit.conf.

PROJECT_NAME="my-company"
AWS_REGION="ap-northeast-1"
GITHUB_ORG="my-org"
ORG_EMAIL_DOMAIN="my-company.com"
02

Run setup

Run bash setup.sh. S3 backend, DynamoDB, and Secrets Manager are configured automatically.

$ bash setup.sh
✓ S3 backend created
✓ DynamoDB lock table created
✓ Secrets Manager initialized
✓ Terraform initialized
03

Push to GitHub

Push triggers GitHub Actions to run Terraform. Organizations built automatically.

$ git push origin main
→ GitHub Actions triggered
→ terraform plan
→ terraform apply
✓ Organizations configured

Pricing

Same features on every plan. Pricing based on team size.

Starter

1–3 people

Free
Community (GitHub Issues)
Contact Us
Recommended

Growth

4–99 people

¥500,000
Email support
Contact Us

Enterprise

100–999 people

¥1,000,000
Dedicated support
Contact Us

Custom

1,000+ people

Contact us
Custom SLA
Contact Us

Included in all plans

AWS Organizations auto-setup
dev / stg / prd auto-creation
Switch Role security
GitHub Actions OIDC integration
MFA enforcement & user management
Full IaC with Terraform

FAQ

Is it really free for teams of 3 or fewer?
Yes. The Starter plan is completely free with full functionality. AWS usage fees apply separately.
What AWS services are created?
AWS Organizations, IAM (users, groups, roles, policies), CloudFormation StackSets, Secrets Manager, S3 (Terraform backend), and DynamoDB (state lock).
Can I customize the roles?
Yes. It's a Terraform module — you can freely customize role policies and permissions.
How are external users (contractors) managed?
External users can be granted access per-project and per-environment (dev/stg/prd). Managed via GitHub Actions workflows.
Is Terraform Cloud required?
No. An S3 + DynamoDB Terraform backend is automatically configured.
Can I use it with an existing AWS account?
Yes, as long as AWS Organizations is enabled. Existing resources are not affected.

Request Documentation

We'll send you detailed documentation. Feel free to reach out.

Your information will only be used to send documentation and follow up.

AWS multi-account environment in 5 minutes

Free for startups of 3 or fewer. Start with the GitHub repository.