cdk bootstrap Command Reference

Provision the CDK toolkit resources an account and region require.

cdk bootstrap creates the CDKToolkit stack: an S3 assets bucket, an ECR repository, and the deployment roles CDK needs. It runs once per account and region before any deploy.

What it does

cdk bootstrap deploys the CDKToolkit CloudFormation stack that cdk deploy depends on for staging assets and assuming deployment roles. It is a one-time (per account and region) setup, occasionally re-run to update the bootstrap version.

Common flags and usage

• aws://ACCOUNT/REGION: bootstrap a specific environment
• --trust ACCOUNT: allow another account to deploy into this one (CI/CD)
• --cloudformation-execution-policies ARN: set the execution policy for deploys
• --qualifier: use a custom resource qualifier for isolated bootstraps
• --toolkit-stack-name: override the default CDKToolkit stack name

Example

- name: CDK Bootstrap
  env:
    AWS_REGION: us-east-1
  run: |
    npx cdk bootstrap aws://${AWS_ACCOUNT_ID}/us-east-1 \
      --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess

In CI

Bootstrapping is idempotent, so a deploy pipeline can run it safely before deploy, though most teams bootstrap once out-of-band. Use --trust to let a central CI/CD account deploy into target accounts, and scope --cloudformation-execution-policies to least privilege rather than AdministratorAccess in production.

Key takeaways

• bootstrap provisions the CDKToolkit stack that cdk deploy depends on.
• It runs once per account and region; re-run only to update the version.
• Use --trust for cross-account CI/CD and scope execution policies tightly.

Related guides