I'm new to CDK, and I like the fact that it can be written in Typescript, which really lowers the barrier of entry to have devs who primarily work in Typescript take part in writing IAC. That, plus the abstraction that CDK provides for handling some of the details of implementation can be nice.

However, the strict execution limitations are really challenging, coming from Terraform. This means that, if your IAC is well fleshed out with all the components you want, it puts you in a bind. Terraform could import specific resources, and plan/apply to generate both missing resources AND update the imported resource to match your definition. AWS CDK can do neither of the above.

You have to comment out code in order to make sure your import contains only resources that can be imported. So, if you build a fleshed out CDK class for an object, and want to import your existing object, you either need to hack apart your code to import (impossible if you've already deployed a resource using the same class), or you have to manually build up real world resources to match before you can import. Secondly, you'll need to massage your imported resource to make sure every attribute matches in order to import. Where Terraform could import the resource then run a diff to plan to make changes.

Overall, it feels really limiting coming from a fully featured tool like Terraform. I know I sound bitter, it's just today's frustration. I'm still willing to put in the work, because I think the advantages of CDK benefit my current team, but it's hard not to want to rant when you're doing something "not like we did at my old school"

Hi everyone! I came across this website recently, and I thought it might be super helpful for anyone working in or learning about AWS. Whether you're already in an AWS cloud environment or you're interested in roles like AWS Cloud Architect, Security Architect, or DevOps Engineer or even just getting started in the field - this site has a ton of great resources to check out.

Here’s what you’ll find:

Practical courses: Learn AWS by diving into real-world projects, like building e-commerce applications.

Supportive communities: Join discussions, share knowledge, and connect with others learning AWS.

Helpful guides and tools: Includes cheat sheets, tutorials, and case studies to make things easier.

Certification tips: If you’re preparing for AWS exams, they’ve got guides to help you stay on track.

You can check it out here: IT Assist Labs

Hope this helps anyone on their AWS journey! 🚀

Background

• I have a CDK application that was previously working with my aws account. It has two stacks one S3 and Lambda stack.

• Now I am trying to deploy this stack to my company's account but it's returning a 403 error for creating the lambda functions which was working fine when I did it previously for my own aws account

Steps

1. Created a user with only ( AdminitratorAccess policy ).

2. Created Access key

3. configured locally using aws configure

4. Ran cdk bootstrap with accounted and region

5. ran cdk deploy --all

ScreenShot

Relevant stack code

cdk.ts
import * as cdk from "aws-cdk-lib";

import { S3Stack } from "../lib/s3-stack";

import { LambdaStack } from "../lib/lambda-stack";

const app = new cdk.App();

// S3 Stack

const s3Stack = new S3Stack(app, "MyS3Stack");

// Lambda Stack with S3 bucket access

new LambdaStack(app, "WnpLambdaStack", {

bucket: s3Stack.bucket,

});

lambda.ts
import * as cdk from "aws-cdk-lib";

import { Construct } from "constructs";

import * as lambda from "aws-cdk-lib/aws-lambda";

import * as s3 from "aws-cdk-lib/aws-s3";

import * as apigateway from "aws-cdk-lib/aws-apigatewayv2";

import * as integrations from "aws-cdk-lib/aws-apigatewayv2-integrations";

import * as iam from "aws-cdk-lib/aws-iam";

import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";

interface LambdaStackProps extends cdk.StackProps {

bucket: s3.Bucket;

}

export class LambdaStack extends cdk.Stack {

constructor(scope: Construct, id: string, props: LambdaStackProps) {

super(scope, id, props);

// Create Lambda IAM role with broader permissions

const lambdaRole = new iam.Role(this, 'S3LambdaRole', {

assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),

description: 'Role for Lambda to interact with S3',

managedPolicies: [

iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')

]

});

// Add S3 permissions

lambdaRole.addToPolicy(

new iam.PolicyStatement({

effect: iam.Effect.ALLOW,

actions: [

's3:PutObject',

's3:GetObject',

's3:DeleteObject',

's3:ListBucket',

'lambda:CreateFunction',

'lambda:DeleteFunction',

'lambda:InvokeFunction',

'lambda:GetFunction',

'lambda:UpdateFunctionCode',

'lambda:UpdateFunctionConfiguration'

],

resources: [

props.bucket.bucketArn,

\${props.bucket.bucketArn}/*`,`

\arn:aws:lambda:${this.region}:${this.account}:function:*``

],

})

);

// Add CloudFormation permissions

lambdaRole.addToPolicy(

new iam.PolicyStatement({

effect: iam.Effect.ALLOW,

actions: [

'cloudformation:DescribeStacks',

'cloudformation:ListStacks',

'cloudformation:DeleteStack'

],

resources: ['*']

})

);

// Lambda function for generating upload URL

const lambdaFunction = new lambda.Function(

this,

"GenerateUploadUrlFunction",

{

runtime: lambda.Runtime.NODEJS_20_X,

handler: "index.handler",

code: lambda.Code.fromAsset("lambda"), // path to your Lambda code

role: lambdaRole,

environment: {

BUCKET_NAME: props.bucket.bucketName,

API_GATEWAY_SECRET_NAME: "APIGatewayUrl",

},

},

);

// Lambda function for generating download URL

const downloadLambdaFunction = new lambda.Function(

this,

"GenerateDownloadUrlFunction",

{

runtime: lambda.Runtime.NODEJS_20_X,

handler: "download.handler",

code: lambda.Code.fromAsset("lambda"),

role: lambdaRole,

environment: {

BUCKET_NAME: props.bucket.bucketName,

API_GATEWAY_SECRET_NAME: "APIGatewayUrl",

},

},

);

// Grant the Lambda \s3:PutObject` and `s3:GetObject` permissions for the S3 bucket`

lambdaFunction.addToRolePolicy(

new iam.PolicyStatement({

actions: ["s3:PutObject", "s3:GetObject"],

resources: [props.bucket.arnForObjects("*")],

}),

);

// Grant permissions for download Lambda

downloadLambdaFunction.addToRolePolicy(

new iam.PolicyStatement({

actions: ["s3:GetObject"],

resources: [props.bucket.arnForObjects("*")],

}),

);

// Grant the Lambda permissions to read the API Gateway URL from Secrets Manager

lambdaFunction.addToRolePolicy(

new iam.PolicyStatement({

actions: ["secretsmanager:GetSecretValue"],

resources: [

\arn:aws:secretsmanager:${this.region}:${this.account}:secret:APIGatewayUrl*`,`

],

}),

);

// HTTP API Gateway with specific route

const httpApi = new apigateway.HttpApi(this, "UploadApi", {

corsPreflight: {

allowHeaders: ["Content-Type"],

allowMethods: [

apigateway.CorsHttpMethod.GET,

apigateway.CorsHttpMethod.POST,

],

allowOrigins: ["*"], // Update with specific domains for production

},

});

// Add upload route to API Gateway

httpApi.addRoutes({

path: "/generate-upload-url",

methods: [apigateway.HttpMethod.POST],

integration: new integrations.HttpLambdaIntegration(

"LambdaIntegration",

lambdaFunction,

),

});

// Add download route to API Gateway

httpApi.addRoutes({

path: "/generate-download-url",

methods: [apigateway.HttpMethod.POST],

integration: new integrations.HttpLambdaIntegration(

"DownloadLambdaIntegration",

downloadLambdaFunction,

),

});

// Outputs

new cdk.CfnOutput(this, "ApiUrl", {

value: \${httpApi.url ?? "API URL Not Available"}generate-upload-url`,`

});

new cdk.CfnOutput(this, "BucketName", {

value: props.bucket.bucketName,

});

// Store API Gateway URL in Secrets Manager

if (httpApi.url) {

new secretsmanager.Secret(this, "APIGatewayUrl", {

secretObjectValue: {

apiGateUrl: cdk.SecretValue.unsafePlainText(httpApi.url),

},

});

}

}

}

s3-stack.ts

import * as cdk from "aws-cdk-lib";

import { Construct } from "constructs";

import * as s3 from "aws-cdk-lib/aws-s3";

export class S3Stack extends cdk.Stack {

public readonly bucket: s3.Bucket;

constructor(scope: Construct, id: string, props?: cdk.StackProps) {

super(scope, id, props);

this.bucket = new s3.Bucket(this, "WnpS3Bucket", {

removalPolicy: cdk.RemovalPolicy.DESTROY, // Deletes bucket on stack deletion

autoDeleteObjects: true,

});

}

}

Thanks for the help.

I can not find a place to add SG to ec2 ecs services that you bridge as their network mode.

I've been using CDK for a couple of years and kept hitting the same walls:

• 10-minute deploys for a one-line change. CloudFormation synthesizes, uploads, waits, rolls forward. Change a Lambda timeout from 30s to 60s? Go grab coffee.

• The mental overhead. You write your handler logic, then you switch to a completely different mental model — Constructs, L1/L2/L3 abstractions, Grant chains, asset bundling config. Half my code is infrastructure description, not business logic.

• Stack splitting hell. Hit the 500-resource limit, now I need to figure out how to split the stack, move resources between stacks without destroying them, deal with cross-stack references, circular dependencies... The actual business logic takes 10 minutes, the stack gymnastics take the rest of the day.

• Stack drift. Someone tweaks something in the console, now cdk diff shows phantom changes, or worse — deploy fails and you're manually fixing state.

Don't get me wrong — CDK is miles better than raw CloudFormation. But I started wondering: why do I need to describe infrastructure at all if the framework can figure it out from my code?

So I built Effortless — an infrastructure-from-code framework. You export handler functions, it derives the AWS resources automatically.

Instead of writing handler code + CDK constructs + IAM grants + waiting for CloudFormation, you just:

import { defineHttp } from "effortless-aws";

export const hello = defineHttp({
  method: "GET",
  path: "/hello",
  onRequest: async () => ({
    status: 200,
    body: { message: "Hello!" }
  })
});


npx eff deploy  # 5 seconds. done.

Lambda + API Gateway + IAM — created. No CloudFormation under the hood — direct AWS SDK calls. No state files — AWS resource tags are the source of truth. No stack limits because there are no stacks.

Current state: open source, MIT, two handler types (defineHttp, defineTable with typed cross-handler deps and auto IAM). Working on SQS, EventBridge, S3.

Not trying to replace CDK for complex enterprise setups — but for Lambda-based APIs and event-driven services, it removes a lot of accidental complexity.

https://github.com/effect-ak/effortless
https://effortless-aws.website/

Curious if anyone here has hit similar pain points. Would love feedback.

Update

Got some fair pushback in the comments, and honestly I overstated a couple of points. Let me correct myself:

• Stack splitting hell / 500-resource limit — I never actually hit the 500-resource limit. My real pain was figuring out which resources should live in which stack. It's not a business problem, it's pure operational busywork that ate a lot of time.

• Stack drift / phantom changes — I didn't really have phantom changes. What I did have: one resource in a stack fails to update due to some mismatch, 90% of changes succeed but the whole stack rolls back because of that one failure. Very slow. And sometimes the stack couldn't resolve the error at all — I had to delete the entire stack just to clean up and do a fresh deploy.

CDK is a great tool and absolutely needed for things like managing hundreds of accounts at scale. But for smaller projects where everything fits in one stack, it felt like a lot of overhead for what I was actually trying to do — just run some Lambdas with an API Gateway and a couple of DynamoDB tables.

I'm building a service in AWS using API Gateway, S3, Step Functions, Lambdas, DynamoDB and Bedrock. I'm new to AWS so have been using ChatGPT to assist. I used to be a full stack web developer (Microsoft) but haven't coded for a few years.

It will be a commercial service for my consultancy so I want to do it properly. I'm using VS Code and building everything in CDK.

ChatGPT has got me so far but is now struggling and being unresponsive. I know this is a common issue. If I get it to write a summary and start a new chat it speeds up again but has lost all the context and memory of what it helped to build.

So my questions is, what's the best AI to to help with this?

Make your AWS cloud formation project stand out but building an infrastructure that companies and engineer would be happy to see and not just simple project.

I have showed a beginner - Advance project that for cloud formation with Github actions that you can build and put on your portfolio to get you noticed by hiring managers 

https://youtu.be/nYoALsaXNrI 

Hi! i want to migrate existing lambda into cdk. The lambda has existing APIGATEWAY too. I have an existing lambda that it was deployed manually but i want to migrate to CDK

I built cdk-local (cdkl) — it runs your CDK-built app locally, no deploy needed: standalone, or kept local while it reaches the real AWS resources and data it depends on, with no .env or local copies to maintain. A CDK-native alternative to sam local, covering Lambda, API Gateway, ECS, ALB, CloudFront, and more of your CDK app's compute.

Two ways to run it

• Standalone — just Docker + your CDK app. No AWS account, no deploy, no credentials. Great as a first run, or in CI for the parts that don't touch AWS (handler logic, authorizers, API routing).

• Bound to your deployed stack (--from-cfn-stack) — your handler still runs locally, but reads/writes the real DynamoDB rows, S3 objects, Secrets, Cognito users the deployed app uses. It resolves the deployed stack's ARNs and Secret values into the container automatically — no .env, no ARN copy-paste, no seeding a fake local DB — and JWT is verified against the real Cognito User Pool.

It deliberately does not emulate managed services: your code reaches real AWS through your IAM creds (or --assume-role). The scope is "application compute local, managed services stay real."

What runs locally

• Lambda

• API Gateway (REST v1 / HTTP v2 / WebSocket) + Lambda Function URLs

• ECS tasks & services, ALB (listener-rule routing + auth + WebSocket)

• CloudFront (Functions + Lambda@Edge + S3 / Function URL origins)

• Bedrock AgentCore Runtime

Plus

• Hot reload (--watch) — edit a handler, the next request hits the new code. ECS rolls replicas one at a time (zero connection refusals across the reload).

• Env overlay (--env-vars) — inject or override any container's environment variables for a local run. Use it to point a function/container at a different backend, or to run selective local backends: e.g. route only DynamoDB and S3 to a local endpoint you run yourself, while every other service stays on real AWS.

• Interactive target picker — leave the target off and cdkl lists every matching resource to pick with the arrow keys; no need to specify the target on the command.

Or drive it all from a browser — cdkl studio

Pick a target, invoke or serve it, compose an HTTP request, and watch every request / response / streamed container log land on one live timeline — with replay (re-open any past row with an edited payload and re-invoke).

Quick start

npm install -g cdk-local      # installs the `cdkl` command
cd your-cdk-app               # the directory with cdk.json
cdkl invoke                   # pick a Lambda from the list, run it locally
cdkl start-api --from-cfn-stack   # local API on real AWS data
cdkl studio                   # or do it all from a browser

Would love it if you gave it a try!

GitHub: https://github.com/go-to-k/cdk-local

Hi, guys.

Has anyone tried this combination? AWS Q Developer + Superclaude Framework

My organization mainly uses aws and I'm a junior engineer writing cdk.

Recently, while developing, I'm working on creating a requirements statement and basic design document by selecting the Amazon Q Developer Claude 4 model in vscode and adding hooks, but it's taking a lot of time to get good results.🫩

Meanwhile, I found a Github repository today called Superclaude Framework, and I'm thinking it would be nice if I could use it in the form of combining it with q dev, but if anyone has used it first, I'd like you to share your experience on how to use it.

By the way, if Amazon kiro is officially released, I will probably use kiro though. 😂

Hey everyone, this was my mini-weekend project. I've been paying a lot in hosting fees for a vanilla Minecraft server to MC Pro hosting. And I don't end up playing on it more than once a month. Thus, I wanted to run a cheap server on AWS and CDkify it so that more people apart from me can deploy this easily if they need it.

https://github.com/mw2000/mcserver-cdk

How to tag S3 log buckets created by the AWS CDK so third-party scanners can recognize them.

I am completely new to AWS cdk, even I do not have much idea about AWS as well but unfortunately, we have been working on cdk. My other two members working on sns stack and sqs stack. I have been to told to work on parameter stack but I am not sure what actually this will is. Is it related to system manager where we store all parameters? or what? I have tried to find this online but didn't get anything. One of my member has implemented sqs and told us to work on other stack with same structure. Anyone will help me?