One config file.
Complete AWS multi-account setup.
Securely automate AWS Organizations with Terraform + GitHub Actions. One config file, one command — production-ready infrastructure.
# 1. Edit config
$ vim starter-kit.conf
PROJECT_NAME="my-company"
AWS_REGION="ap-northeast-1"
GITHUB_ORG="my-org"
# 2. Run setup
$ bash setup.sh
✓ S3 backend created
✓ DynamoDB table created
✓ Secrets Manager initialized
✓ Terraform initialized
# 3. Push & deploy
$ git push origin main
→ GitHub Actions: terraform apply
✓ AWS Organizations configured
✓ Ready to create projects!
Sound familiar?
Common problems teams face when adopting AWS. Manual management doesn't scale.
Manual account management leads to errors
Click-ops in the console. No audit trail. Missed settings cause production incidents.
Secrets accidentally committed to Git
AWS access keys in .env files, accidentally pushed. A story as old as Git itself.
Inconsistent dev / stg / prd environments
Hand-built environments differ subtly. "It worked in staging..."
Direct IAM permissions are a security risk
Users with direct AdministratorAccess. Manual revocation on offboarding.
Long-lived access keys for CI/CD
Access keys stored in GitHub Secrets. When was the last rotation? What if they leak?
What AWS Starter Kit Does
Enterprise-grade multi-account management, accessible to startups.
ReadOnly User Auto-Provisioning
New users created with secure defaults. MFA required, forced password reset.
AWS Organizations Management
OU structure, account creation, and automatic role distribution via StackSets — all as code.
create project → dev/stg/prd
Enter a project name in GitHub Actions. Three environments created automatically.
Feature Branch Environments
Push a branch, get an environment. Merge it, it's gone. Vercel-like experience on AWS.
Switch Role Security
No direct permissions on management account. Access member accounts only via Switch Role.
MFA Enforcement
Console and API locked until MFA is configured. Security baseline guaranteed.
GitHub Actions OIDC
No access keys. OIDC federation provides temporary credentials automatically.
One Config File
Edit starter-kit.conf, run setup.sh. That's it — your environment is ready.
Why Switch Role?
Cross-account access based on AWS best practices
Switch Role is the core security pattern for multi-account operations recommended by AWS. Compared to granting direct permissions to users, it provides dramatically better security and manageability.
How it works
IAM users in the management account have no direct operational permissions. They can only operate by switching to DeveloperRole or ReadRole in member accounts.
Benefits
- Naturally enforces the principle of least privilege
- Complete audit trail via CloudTrail — who accessed what, when
- On offboarding, just delete the IAM user — all access revoked instantly
- External users (contractors) get per-project, per-environment access control
Architecture
Hierarchical multi-account structure via AWS Organizations
Management Account (Central Control) ├── IAM Users (MFA Required) │ ├── developers group → DeveloperRole (all projects) │ └── readers group → ReadRole (all projects) │ ├── GitHub Actions OIDC Provider │ └── Temporary credentials (no access keys) │ ├── Secrets Manager │ └── /terraform/config (single source of truth) │ └── Organizations └── projects OU ├── dev OU │ ├── dev-project-a ← feature branches OK │ └── dev-project-b │ ├── stg OU │ ├── stg-project-a ← develop branch only │ └── stg-project-b │ └── prd OU ├── prd-project-a ← main branch only └── prd-project-b
Get started in 3 steps
Production-ready AWS environment in 5 minutes.
Edit the config file
Enter your project name and AWS region in starter-kit.conf.
PROJECT_NAME="my-company" AWS_REGION="ap-northeast-1" GITHUB_ORG="my-org" ORG_EMAIL_DOMAIN="my-company.com"
Run setup
Run bash setup.sh. S3 backend, DynamoDB, and Secrets Manager are configured automatically.
$ bash setup.sh ✓ S3 backend created ✓ DynamoDB lock table created ✓ Secrets Manager initialized ✓ Terraform initialized
Push to GitHub
Push triggers GitHub Actions to run Terraform. Organizations built automatically.
$ git push origin main → GitHub Actions triggered → terraform plan → terraform apply ✓ Organizations configured
Pricing
Same features on every plan. Pricing based on team size.
Included in all plans
FAQ
Is it really free for teams of 3 or fewer?
What AWS services are created?
Can I customize the roles?
How are external users (contractors) managed?
Is Terraform Cloud required?
Can I use it with an existing AWS account?
Request Documentation
We'll send you detailed documentation. Feel free to reach out.
AWS multi-account environment in 5 minutes
Free for startups of 3 or fewer. Start with the GitHub repository.