Open-Source DevOps · org-formation

org-formation-cli

org-formation-cli is an Infrastructure-as-Code tool for managing AWS Organizations, accounts, organizational units, and service control policies via declarative YAML templates. It also enables cross-account CloudFormation deployments and automated account provisioning workflows.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/org-formation/org-formation-cli

1.5k

GitHub stars

135

Forks

TypeScript

Primary language

MIT

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	org-formation/org-formation-cli
Owner	org-formation
Primary language	TypeScript
License	MIT — OSI-approved
Stars	1.5k
Forks	135
Open issues	99
Latest release	v1.0.14 (2024-04-09)
Last updated	2026-01-19
Source	https://github.com/org-formation/org-formation-cli

What org-formation-cli is

TypeScript-based CLI that extends CloudFormation with custom resource types (OC::ORG::*) to codify organization structure, applies changes via org-formation init/update/create-change-set commands, and orchestrates multi-account resource provisioning through task files with concurrent execution support.

Quickstart

Get the org-formation-cli source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/org-formation/org-formation-cli.git2cd org-formation-cli3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

Multi-account AWS organization setup

Define accounts, OUs, and SCPs as code; initialize from existing org with org-formation init; version control and review changes before applying.

Cross-account CloudFormation deployments

Use CloudFormation annotations to deploy stacks across multiple member accounts from a single template, automating account-level infrastructure provisioning.

Organization automation and account vending

Implement self-service account creation workflows via task files; orchestrate account setup, OU assignment, and policy attachment in parallel for large organizations.

Implementation considerations

Requires unique email address per AWS account (tool documents workaround using '+' addressing on compatible mail providers).
High-privilege credentials needed for master account; MFA setup recommended but requires additional IAM role and profile configuration.
Concurrent execution flags (--max-concurrent-stacks, --max-concurrent-tasks) needed for large orgs to avoid slow operations; logging may become difficult with high parallelism.
State and change management via org-formation change-set workflow; understand drift detection and reconciliation behavior before deploying.
Task file orchestration supports sequential and parallel execution; complex multi-stage workflows require careful task dependency and ordering design.

When to avoid it — and what to weigh

Single-account deployments only — Tool is designed for multi-account organization management; overhead and complexity not justified for simple single-account setups.
AWS Control Tower as primary tool — If you require Control Tower's enrollment, guardrail automation, and dashboard features, org-formation is complementary but not a replacement.
Limited AWS Organizations API permissions — Tool requires high-privilege access to master account for organization operations; restrictive IAM policies or lack of root/delegated admin access will block usage.
Real-time, manual-first operations culture — Tool assumes IaC workflows and version control integration; teams preferring manual console operations or imperative scripts may struggle with adoption.

License & commercial use

MIT License: permissive, OSI-approved open-source license. Allows commercial use, modification, and distribution with proper attribution.

MIT is a permissive OSI license that permits commercial use without restriction. No license-based barriers to using this tool in production or commercial organizations. No indication of proprietary licensing, vendor lock-in, or commercial SaaS offering in the provided data.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Adequate
License clarity	Clear
Deployment complexity	Moderate
DEV.co fit	Good
Assessment confidence	High

Security considerations

Tool requires master account credentials with high privilege (org-formation needs to create/modify accounts and apply SCPs). Credentials must be managed securely; MFA is recommended and documented. Docker execution can isolate credential handling. No mention of audit logging, compliance drift detection, or secrets management integration. Review SCP syntax carefully for unintended permission restrictions. No data on vulnerability disclosure process or known CVEs.

Alternatives to consider

AWS Control Tower

AWS-native service for governed multi-account setup; provides guardrails, account factory, and compliance dashboard. Lighter lift for AWS-managed organization structure but less flexible for custom policies and existing org migrations.

Terraform + terraform-aws-modules (aws-organization module)

Cloud-agnostic IaC alternative; larger ecosystem and state management. Steeper learning curve and requires separate state backend, but avoids vendor lock-in to AWS Organizations API.

AWS CloudFormation native (no custom types)

Use standard CloudFormation stacks for account-level resources where possible. Limited to IAM roles, SCPs, and org-level resources that have CloudFormation support; does not support cross-account deployment annotations.

Software development agency

Build on org-formation-cli with DEV.co software developers

Start with org-formation init to import your existing organization, then version control and automate multi-account provisioning. Check the docs and Slack community for hands-on support.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

aws-sso-cli lms azure-devops-cli-extension

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source DevOps DevOps infrastructure automation Cloud deployment and multi-account management Talk to DEV.co

org-formation-cli FAQ

How do I speed up org-formation operations?

Use --max-concurrent-stacks and --max-concurrent-tasks flags (e.g., value 10) to parallelize stack and task execution. Expect logging to be harder to correlate with specific operations at high parallelism.

Do I need a separate email for each AWS account?

Yes, every account requires a unique root email. Workaround: use '+' addressing (e.g., [email protected]) on compatible mail providers (Gmail, AWS Workmail, Hotmail) to route to a single inbox.

Can I use MFA with org-formation?

Yes. Set up an IAM user with MFA device, create a role with high privilege that enforces MFA, and configure an AWS profile to assume that role. Use --profile flag when running org-formation commands.

Does org-formation replace AWS Control Tower?

Not entirely. org-formation is more flexible for IaC-driven org management and drift handling; Control Tower provides guardrails and dashboards. They can be complementary depending on your governance model.

Custom software development services

Need help beyond evaluating org-formation-cli? DEV.co is a software development agency offering software development services and web development for teams of every size. Our software developers and web developers build custom software, web applications, APIs, and open-source devops integrations — and maintain them long-term.

Ready to codify your AWS organization?

Start with org-formation init to import your existing organization, then version control and automate multi-account provisioning. Check the docs and Slack community for hands-on support.

Talk to DEV.co Schedule a Consultation