Bootstrap accounts
Bootstrap infrastructure configured with config sets to the specified organizational units and accounts.


tkm org accounts bootstrap [ou-path...] \
[--account <account_id>]... \
[--concurrent-accounts <number>] \
[--config-set <config-set>] \
[--command-path <command-path>]

Positional arguments

  • ou-path...
    • You can pass one or more organizational unit paths to bootstrap only the accounts that belong to organizational units located under the given paths in the organization hierarchy.


In addition to the common options, this command has the following options.
  • --account <account id>
    • Choose accounts to bootstrap. You can use this option multiple times to specify more accounts.
  • --concurrent-accounts <number>
    • Number of accounts to bootstrap concurrently.
  • --config-set <config-set>
    • Bootstrap only this config set.
    • Optional.
  • --command-path <command-path>
    • Bootstrap only stacks under this command path.
    • Optional.
    • To use this option, also the --config-set option must be given.

IAM permissions

These are the minimum IAM permissions required to run this command.
- Effect: Allow
- organizations:ListRoots
- organizations:ListTargetsForPolicy
- organizations:ListAWSServiceAccessForOrganization
- organizations:DescribePolicy
- organizations:ListPolicies
- organizations:ListAccountsForParent
- organizations:ListAccounts
- organizations:DescribeOrganization
- organizations:ListOrganizationalUnitsForParent
Resource: "*"
# IAM permissions needed to assume role from the target accounts.
# Specify resource to restrict access to specific roles.
- Sid: IAM
Effect: Allow
- sts:AssumeRole
Resource: "*"


Bootstrap all accounts in the organization.
tkm org accounts bootstrap
Bootstrap only accounts that belong to the organizational unit Root/Sandbox or to any organizational units under it.
tkm org accounts bootstrap Root/Sandbox
Copy link
On this page
Positional arguments
IAM permissions