Fjall Docs — deploy AWS infrastructure into your own account

The platform account is the shared-services tier of a Fjall organisation. Deploying it provisions the organisation’s IP address space and the account baseline every Fjall-managed account carries.

Prerequisites

Install the Fjall CLI (requires Node 22+)
Deploy the organisation so the platform account exists and is registered
Read Understanding Profiles for how Fjall derives AWS credentials

The platform tier belongs to organisations only. fjall create organisation scaffolds fjall/platform/infrastructure.ts. A single connected account created with fjall create account has no platform tier at all, so skip this page and go straight to Deploy Account.

When you need this command

fjall org deploy cascades to the platform account by default, so a first-time organisation deploy already deploys it. Run fjall platform deploy on its own when you:

Deployed the organisation with --no-cascade
Changed fjall/platform/infrastructure.ts and want to apply that stack alone
Added a region and want the IPAM pool extended into it

Deploy the platform account

Run this from the root of your project:

fjall platform deploy

Tier deploys are noun-verb. fjall deploy platform is retired and fails before any AWS call with an error pointing at the spelling above.

Where it deploys

Fjall picks the account and region for you. The active deployment target set by fjall target set does not apply to a platform deploy.

Choice	How Fjall resolves it
Account	The platform-tier account in your organisation config, found by tier. No flag or active target changes this.
Region	The organisation’s primary region, unless `--target` names a different platform target.

With no platform-tier account in the organisation config, the deploy fails with No platform account found. Run fjall org deploy first to sync accounts. To deploy the platform account into a second region, pass a platform target:

fjall platform deploy --target platform-euw1

Target names are <account>-<abbreviated-region>, so a platform account named platform in eu-west-1 is platform-euw1. Run fjall target list to see every derived target. A --target that resolves to any other account is refused with a teaching error.

What happens

Step	Action
Authenticating with AWS	Fjall mints credentials for the platform account from your `fjall login` session. No AWS profile is read or written.
Connect securely	Confirms the minted credentials are in hand before any synthesis runs.
Prepare environment	Synthesises the platform stack, bootstraps the CDK environment, and compares template hashes.
Deploy infrastructure	CloudFormation applies the change set and streams a per-resource event table.
Enable monitoring	Signals post-deploy readiness. CloudTrail and alarms ship as part of the account baseline.

A platform deploy has no diff-review prompt and no typed confirmation. --skip-confirmation is accepted for symmetry with the other tiers but changes nothing on this path.

What the platform stack provisions

The platform stack is the account baseline plus the organisation’s shared network address space.

Resource	Purpose
IPAM and the organisation pool	Allocates non-overlapping CIDR ranges to every member account across every region.
Platform deploy role	The OIDC-trusted role Fjall assumes to deploy into this account.
Monitoring and audit roles	Cross-account read roles Fjall uses for posture and cost data.
CloudTrail management trail	Records management events for the account.
Alarm topic	Shared SNS topic every stack in the account publishes alarms to.
Account guardrails	S3 block public access and EBS default encryption, applied account-wide.
Default ECR image helper	A CodeBuild role that seeds a placeholder image into newly created ECR repositories.

Create the organisation with the Regulated or Enforced governance profile and the platform account additionally becomes the delegated administrator for GuardDuty, Security Hub, and AWS Config.

Custom domains are not part of the platform stack. Deploy them with fjall domain deploy <domain>, or let the organisation cascade’s domains phase handle them. See Custom Domain.

Output

In a terminal the CLI renders a live step checklist, streams the CloudFormation resource table for the platform stack, and closes with a next-steps panel pointing at fjall account deploy. When the synthesised template matches what is already deployed, it prints No changes to deploy. Your infrastructure is up to date. instead. With --non-interactive the same run ends in a plain summary block:

── Summary ───────────────────────────────────
  Result:   ✓ platform deployed successfully
  Duration: 3m 12s
──────────────────────────────────────────────

Options

Flag	Description
`--target <name>`	Deploy to a specific platform target. Must resolve to the platform account.
`-f, --force`	Redeploy even when no infrastructure changes are detected.
`--skip-confirmation`	Skip deployment confirmation prompts.
`--non-interactive`	Force plain CLI output with no interactive UI.
`-v, --verbose`	Enable verbose output.
`--agent`	Enable agent output mode.
`--budget <level>`	Output budget: `minimal`, `compact`, or a token count.
`--fields <fields>`	Select exactly these output fields.
`--full`	Disable content truncation.

--region, -e, --environment, and --skip-migrations are application-deploy flags. The platform tier registers none of them, so passing one fails with an unknown option error before anything is validated or deployed.

To tear the platform stack down, use fjall platform destroy, which takes -f, --force, --skip-confirmation, and --target <name>.

Next Steps

Deploy Account

Deploy the baseline into each member account.

Understanding Profiles

See how Fjall derives AWS credentials and deployment targets.

Deploy Organisation

Review the organisation deploy and its cascade.

Custom Domain

Attach a domain with fjall domain deploy.

Install & Setup

Application Deploy

Deployment Errors

Organisation Setup

Organisation Deploy

Deploy Platform

Prerequisites

When you need this command

Deploy the platform account

Where it deploys

What happens

What the platform stack provisions

Output

Options

Next Steps

Deploy Account

Understanding Profiles

Deploy Organisation

Custom Domain

​Prerequisites

​When you need this command

​Deploy the platform account

​Where it deploys

​What happens

​What the platform stack provisions

​Output

​Options

​Next Steps

Deploy Account

Understanding Profiles

Deploy Organisation

Custom Domain

Prerequisites

When you need this command

Deploy the platform account

Where it deploys

What happens

What the platform stack provisions

Output

Options

Next Steps