create-aws-project 1.5.1 → 1.7.0

package/dist/commands/setup-aws-envs.js

@@ -9,8 +9,15 @@ import prompts from 'prompts';
 import pc from 'picocolors';
 import { readFileSync, writeFileSync } from 'node:fs';
 import { requireProjectContext } from '../utils/project-context.js';
-import { createOrganizationsClient, checkExistingOrganization, createOrganization, createAccount, waitForAccountCreation, } from '../aws/organizations.js';
-import { createCrossAccountIAMClient, createOrAdoptDeploymentUser, createCDKDeploymentPolicy, attachPolicyToUser, } from '../aws/iam.js';
+import { loadSetupAwsEnvsConfig, deriveEnvironmentEmails } from '../config/non-interactive-aws.js';
+import { createOrganizationsClient, checkExistingOrganization, createOrganization, createAccount, waitForAccountCreation, listOrganizationAccounts, } from '../aws/organizations.js';
+import { createIAMClient, createCrossAccountIAMClient, createOrAdoptDeploymentUser, createCDKDeploymentPolicy, attachPolicyToUser, createAccessKey, } from '../aws/iam.js';
+import { bootstrapAllEnvironments } from '../aws/cdk-bootstrap.js';
+import { detectRootCredentials, createOrAdoptAdminUser, } from '../aws/root-credentials.js';
+import { runInitializeGitHub } from './initialize-github.js';
+import { IAMClient } from '@aws-sdk/client-iam';
+import { OrganizationsClient } from '@aws-sdk/client-organizations';
+import { fromTemporaryCredentials } from '@aws-sdk/credential-providers';
 /**
  * Environment names for account creation
  */
@@ -47,16 +54,21 @@ function validateUniqueEmail(value, existing) {
     return true;
 }
 /**
- * Collects unique email addresses for each environment account
+ * Collects unique email addresses for environments that need account creation
  * @param projectName Project name for display
- * @returns EnvironmentEmails object with dev, stage, prod emails
+ * @param environmentsToCreate Array of environment names that need accounts
+ * @returns Record of environment name to email address
  */
-async function collectEmails(projectName) {
+async function collectEmails(projectName, environmentsToCreate) {
     console.log('');
     console.log(pc.bold('AWS Account Configuration'));
     console.log('');
     console.log(`Setting up environment accounts for ${pc.cyan(projectName)}`);
     console.log('');
+    if (environmentsToCreate.length < ENVIRONMENTS.length) {
+        console.log(pc.dim('Note: Only collecting emails for accounts that need creation.'));
+        console.log('');
+    }
     console.log('Each AWS environment account requires a unique root email address.');
     console.log(pc.dim('Tip: Use email aliases like yourname+dev@company.com'));
     console.log('');
@@ -64,56 +76,69 @@ async function collectEmails(projectName) {
         console.log(`\n${pc.red('x')} Setup cancelled`);
         process.exit(1);
     };
-    // Collect emails sequentially to enable uniqueness validation
-    const devResponse = await prompts({
-        type: 'text',
-        name: 'dev',
-        message: 'Dev account root email:',
-        validate: validateEmail,
-    }, { onCancel });
-    if (!devResponse.dev) {
-        console.log(pc.red('Error:') + ' Dev email is required.');
-        process.exit(1);
+    const emails = {};
+    const collectedEmails = [];
+    if (environmentsToCreate.includes('dev')) {
+        const response = await prompts({
+            type: 'text',
+            name: 'dev',
+            message: 'Dev account root email:',
+            validate: validateEmail,
+        }, { onCancel });
+        if (!response.dev) {
+            console.log(pc.red('Error:') + ' Dev email is required.');
+            process.exit(1);
+        }
+        emails.dev = response.dev;
+        collectedEmails.push(response.dev);
     }
-    const stageResponse = await prompts({
-        type: 'text',
-        name: 'stage',
-        message: 'Stage account root email:',
-        validate: (v) => validateUniqueEmail(v, [devResponse.dev]),
-    }, { onCancel });
-    if (!stageResponse.stage) {
-        console.log(pc.red('Error:') + ' Stage email is required.');
-        process.exit(1);
+    if (environmentsToCreate.includes('stage')) {
+        const response = await prompts({
+            type: 'text',
+            name: 'stage',
+            message: 'Stage account root email:',
+            validate: (v) => validateUniqueEmail(v, collectedEmails),
+        }, { onCancel });
+        if (!response.stage) {
+            console.log(pc.red('Error:') + ' Stage email is required.');
+            process.exit(1);
+        }
+        emails.stage = response.stage;
+        collectedEmails.push(response.stage);
     }
-    const prodResponse = await prompts({
-        type: 'text',
-        name: 'prod',
-        message: 'Prod account root email:',
-        validate: (v) => validateUniqueEmail(v, [devResponse.dev, stageResponse.stage]),
-    }, { onCancel });
-    if (!prodResponse.prod) {
-        console.log(pc.red('Error:') + ' Prod email is required.');
-        process.exit(1);
+    if (environmentsToCreate.includes('prod')) {
+        const response = await prompts({
+            type: 'text',
+            name: 'prod',
+            message: 'Prod account root email:',
+            validate: (v) => validateUniqueEmail(v, collectedEmails),
+        }, { onCancel });
+        if (!response.prod) {
+            console.log(pc.red('Error:') + ' Prod email is required.');
+            process.exit(1);
+        }
+        emails.prod = response.prod;
+        collectedEmails.push(response.prod);
     }
-    return {
-        dev: devResponse.dev,
-        stage: stageResponse.stage,
-        prod: prodResponse.prod,
-    };
+    return emails;
 }
 /**
  * Updates the config file with account IDs and optionally deployment user names
  * @param configPath Path to the config file
  * @param accounts Record of environment to account ID
  * @param deploymentUsers Optional record of environment to deployment user name
+ * @param deploymentCredentials Optional record of environment to deployment credentials
  */
-function updateConfig(configPath, accounts, deploymentUsers) {
+function updateConfig(configPath, accounts, deploymentUsers, deploymentCredentials) {
     const content = readFileSync(configPath, 'utf-8');
     const config = JSON.parse(content);
     config.accounts = { ...config.accounts, ...accounts };
     if (deploymentUsers) {
         config.deploymentUsers = { ...config.deploymentUsers, ...deploymentUsers };
     }
+    if (deploymentCredentials) {
+        config.deploymentCredentials = { ...config.deploymentCredentials, ...deploymentCredentials };
+    }
     writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', 'utf-8');
 }
 /**
@@ -166,20 +191,326 @@ function handleAwsError(error) {
     }
     process.exit(1);
 }
+/**
+ * Runs setup-aws-envs in non-interactive mode using a JSON config file.
+ *
+ * Loads and validates the config, derives per-environment emails, then runs the
+ * full AWS setup flow (org, accounts, IAM users, access keys, CDK bootstrap)
+ * without any interactive prompts. After AWS setup completes, automatically
+ * invokes GitHub environment setup.
+ *
+ * Note: runInitializeGitHub may call process.exit(1) internally for auth failures
+ * (e.g. bad GitHub token). This bypasses the try/catch wrapper — it is a known
+ * limitation. The try/catch only catches thrown JavaScript errors (network, API).
+ *
+ * @param configPath Path to the JSON config file
+ */
+async function runSetupAwsEnvsNonInteractive(configPath) {
+    // Load and validate config
+    const awsConfig = loadSetupAwsEnvsConfig(configPath);
+    // Get project context (validates we're in a project directory)
+    const context = await requireProjectContext();
+    const { config, configPath: projectConfigPath } = context;
+    // Derive per-environment emails from the single root email
+    const emails = deriveEnvironmentEmails(awsConfig.email, ENVIRONMENTS);
+    // Print derived emails for transparency before AWS operations begin
+    console.log('');
+    console.log('Derived environment emails:');
+    for (const [env, email] of Object.entries(emails)) {
+        console.log(`  ${pc.cyan(env)}: ${email}`);
+    }
+    console.log('');
+    // Check if already configured (warn but don't abort - allows retry after partial failure)
+    const existingAccounts = config.accounts ?? {};
+    const existingUsers = config.deploymentUsers ?? {};
+    const existingCredentials = config.deploymentCredentials ?? {};
+    if (Object.keys(existingAccounts).length > 0) {
+        console.log('');
+        console.log(pc.yellow('Warning:') + ' AWS accounts already configured in this project:');
+        for (const [env, id] of Object.entries(existingAccounts)) {
+            const userInfo = existingUsers[env] ? ` (user: ${existingUsers[env]})` : '';
+            console.log(`  ${env}: ${id}${userInfo}`);
+        }
+        console.log('');
+        console.log(pc.dim('Continuing will skip existing accounts and create any missing ones...'));
+    }
+    // Detect root credentials and create admin user if needed
+    let adminCredentials = null;
+    if (config.adminUser) {
+        console.log('');
+        console.log(pc.yellow('Note:') + ` Admin user ${pc.cyan(config.adminUser.userName)} already configured.`);
+        console.log(pc.dim('Using existing admin user. If you have switched to IAM credentials, root detection is skipped.'));
+    }
+    else {
+        try {
+            const identity = await detectRootCredentials(config.awsRegion);
+            if (identity.isRoot) {
+                console.log('');
+                console.log(pc.yellow('Root credentials detected.'));
+                console.log('Creating admin IAM user for subsequent operations...');
+                console.log('');
+                const iamClient = createIAMClient(config.awsRegion);
+                const adminResult = await createOrAdoptAdminUser(iamClient, config.projectName);
+                adminCredentials = {
+                    accessKeyId: adminResult.accessKeyId,
+                    secretAccessKey: adminResult.secretAccessKey,
+                };
+                const configContent = JSON.parse(readFileSync(projectConfigPath, 'utf-8'));
+                configContent.adminUser = {
+                    userName: adminResult.userName,
+                    accessKeyId: adminResult.accessKeyId,
+                };
+                writeFileSync(projectConfigPath, JSON.stringify(configContent, null, 2) + '\n', 'utf-8');
+                if (adminResult.adopted) {
+                    console.log(pc.green(`Adopted existing admin user: ${adminResult.userName}`));
+                }
+                else {
+                    console.log(pc.green(`Created admin user: ${adminResult.userName}`));
+                }
+                console.log(pc.dim('Admin credentials will be used for all subsequent AWS operations in this session.'));
+                console.log('');
+            }
+        }
+        catch (error) {
+            const spinner = ora('').start();
+            spinner.fail('Failed to detect AWS credentials');
+            handleAwsError(error);
+        }
+    }
+    // Execute AWS operations with progress spinner
+    const spinner = ora('Starting AWS Organizations setup...').start();
+    try {
+        // Organizations API requires us-east-1
+        let client;
+        if (adminCredentials) {
+            client = new OrganizationsClient({
+                region: 'us-east-1',
+                credentials: {
+                    accessKeyId: adminCredentials.accessKeyId,
+                    secretAccessKey: adminCredentials.secretAccessKey,
+                },
+            });
+        }
+        else {
+            client = createOrganizationsClient('us-east-1');
+        }
+        // Check/create organization
+        spinner.text = 'Checking for existing AWS Organization...';
+        let orgId = await checkExistingOrganization(client);
+        if (!orgId) {
+            spinner.text = 'Creating AWS Organization...';
+            orgId = await createOrganization(client);
+            spinner.succeed(`Created AWS Organization: ${orgId}`);
+        }
+        else {
+            spinner.succeed(`Using existing AWS Organization: ${orgId}`);
+        }
+        // Discover existing accounts from AWS (source of truth)
+        spinner.start('Checking for existing AWS accounts...');
+        const allOrgAccounts = await listOrganizationAccounts(client);
+        const discoveredAccounts = new Map();
+        for (const account of allOrgAccounts) {
+            for (const env of ENVIRONMENTS) {
+                const expectedName = `${config.projectName}-${env}`;
+                if (account.Name === expectedName && account.Id) {
+                    discoveredAccounts.set(env, account.Id);
+                }
+            }
+        }
+        // Determine which environments still need account creation
+        const environmentsNeedingCreation = ENVIRONMENTS.filter(env => !discoveredAccounts.has(env));
+        // Report findings
+        for (const [env, accountId] of discoveredAccounts.entries()) {
+            spinner.info(`Found existing ${env} account: ${accountId}`);
+        }
+        // Warn if config has accounts not found in AWS
+        for (const [env, accountId] of Object.entries(existingAccounts)) {
+            if (!discoveredAccounts.has(env)) {
+                console.log(pc.yellow('Warning:') + ` Account ${env} (${accountId}) in config but not found in AWS Organization`);
+            }
+        }
+        // Non-interactive: emails are already derived — no collectEmails() call
+        if (environmentsNeedingCreation.length > 0) {
+            spinner.start('Continuing AWS setup with derived emails...');
+        }
+        else {
+            spinner.stop();
+            console.log('');
+            console.log(pc.green('All environment accounts already exist in AWS.'));
+            console.log(pc.dim('Skipping email collection, proceeding to deployment user setup...'));
+            console.log('');
+            spinner.start('Continuing AWS setup...');
+        }
+        // Create accounts sequentially (AWS rate limits require sequential)
+        const accounts = { ...existingAccounts };
+        for (const [env, accountId] of discoveredAccounts.entries()) {
+            accounts[env] = accountId;
+        }
+        if (discoveredAccounts.size > 0) {
+            updateConfig(projectConfigPath, accounts);
+        }
+        for (const env of ENVIRONMENTS) {
+            if (accounts[env]) {
+                spinner.succeed(`Using existing ${env} account: ${accounts[env]}`);
+                continue;
+            }
+            spinner.start(`Creating ${env} account (this may take several minutes)...`);
+            const accountName = `${config.projectName}-${env}`;
+            const { requestId } = await createAccount(client, emails[env], accountName);
+            spinner.text = `Waiting for ${env} account creation...`;
+            const result = await waitForAccountCreation(client, requestId);
+            accounts[env] = result.accountId;
+            updateConfig(projectConfigPath, accounts);
+            spinner.succeed(`Created ${env} account: ${result.accountId}`);
+        }
+        // Create IAM deployment users in each account
+        const deploymentUsers = { ...existingUsers };
+        for (const env of ENVIRONMENTS) {
+            if (existingUsers[env]) {
+                spinner.succeed(`Using existing deployment user: ${existingUsers[env]}`);
+                continue;
+            }
+            const accountId = accounts[env];
+            const userName = `${config.projectName}-${env}-deploy`;
+            const policyName = `${config.projectName}-${env}-cdk-deploy`;
+            spinner.start(`Creating deployment user in ${env} account...`);
+            let iamClient;
+            if (adminCredentials) {
+                const roleArn = `arn:aws:iam::${accountId}:role/OrganizationAccountAccessRole`;
+                iamClient = new IAMClient({
+                    region: config.awsRegion,
+                    credentials: fromTemporaryCredentials({
+                        masterCredentials: {
+                            accessKeyId: adminCredentials.accessKeyId,
+                            secretAccessKey: adminCredentials.secretAccessKey,
+                        },
+                        params: {
+                            RoleArn: roleArn,
+                            RoleSessionName: `create-aws-project-${Date.now()}`,
+                            DurationSeconds: 900,
+                        },
+                    }),
+                });
+            }
+            else {
+                iamClient = createCrossAccountIAMClient(config.awsRegion, accountId);
+            }
+            await createOrAdoptDeploymentUser(iamClient, userName);
+            spinner.text = `Creating deployment policy for ${env}...`;
+            const policyArn = await createCDKDeploymentPolicy(iamClient, policyName, accountId);
+            await attachPolicyToUser(iamClient, userName, policyArn);
+            deploymentUsers[env] = userName;
+            updateConfig(projectConfigPath, accounts, deploymentUsers);
+            spinner.succeed(`Created deployment user: ${userName}`);
+        }
+        // Create access keys for deployment users
+        const deploymentCredentials = {};
+        for (const env of ENVIRONMENTS) {
+            if (existingCredentials[env]) {
+                spinner.succeed(`Using existing credentials for ${env}: ${existingCredentials[env].accessKeyId}`);
+                deploymentCredentials[env] = existingCredentials[env];
+                continue;
+            }
+            const userName = deploymentUsers[env];
+            spinner.start(`Creating access key for ${env} deployment user...`);
+            const accountId = accounts[env];
+            let iamClient;
+            if (adminCredentials) {
+                const roleArn = `arn:aws:iam::${accountId}:role/OrganizationAccountAccessRole`;
+                iamClient = new IAMClient({
+                    region: config.awsRegion,
+                    credentials: fromTemporaryCredentials({
+                        masterCredentials: {
+                            accessKeyId: adminCredentials.accessKeyId,
+                            secretAccessKey: adminCredentials.secretAccessKey,
+                        },
+                        params: {
+                            RoleArn: roleArn,
+                            RoleSessionName: `create-aws-project-${Date.now()}`,
+                            DurationSeconds: 900,
+                        },
+                    }),
+                });
+            }
+            else {
+                iamClient = createCrossAccountIAMClient(config.awsRegion, accountId);
+            }
+            const credentials = await createAccessKey(iamClient, userName);
+            deploymentCredentials[env] = {
+                userName,
+                accessKeyId: credentials.accessKeyId,
+                secretAccessKey: credentials.secretAccessKey,
+            };
+            updateConfig(projectConfigPath, accounts, deploymentUsers, deploymentCredentials);
+            spinner.succeed(`Created access key for ${userName}`);
+        }
+        // Bootstrap CDK in each environment account
+        await bootstrapAllEnvironments({
+            accounts,
+            region: config.awsRegion,
+            adminCredentials,
+            spinner,
+        });
+        // Final success with summary table
+        console.log('');
+        console.log(pc.green('AWS environment setup complete!'));
+        console.log('');
+        console.log('Summary:');
+        console.log(`  ${'Environment'.padEnd(14)}${'Account ID'.padEnd(16)}${'Deployment User'.padEnd(30)}Access Key`);
+        for (const env of ENVIRONMENTS) {
+            const keyId = deploymentCredentials[env]?.accessKeyId ?? 'N/A';
+            console.log(`  ${env.padEnd(14)}${accounts[env].padEnd(16)}${deploymentUsers[env].padEnd(30)}${keyId}`);
+        }
+        console.log('');
+        console.log(pc.dim('CDK bootstrapped in all environment accounts.'));
+        console.log('');
+        console.log('AWS setup complete. All environments bootstrapped and ready for CDK deployments.');
+        console.log('');
+        // Auto-run GitHub setup (non-interactive path — no prompt)
+        console.log('Setting up GitHub environments...');
+        try {
+            await runInitializeGitHub(['--all']);
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            console.warn(pc.yellow('Warning:') + ` GitHub setup failed: ${msg}`);
+            console.warn('AWS setup completed successfully. Run initialize-github manually:');
+            console.warn(`  ${pc.cyan('npx create-aws-project initialize-github --all')}`);
+        }
+    }
+    catch (error) {
+        spinner.fail('AWS setup failed');
+        handleAwsError(error);
+    }
+    process.exit(0);
+}
 /**
  * Runs the setup-aws-envs command
  *
  * Creates AWS Organizations and environment accounts (dev, stage, prod)
  *
- * @param _args Command arguments (unused)
+ * @param args Command arguments
  */
-export async function runSetupAwsEnvs(_args) {
+export async function runSetupAwsEnvs(args) {
+    // --config flag: route to non-interactive mode
+    const configFlagIndex = args.findIndex(arg => arg === '--config');
+    if (configFlagIndex !== -1) {
+        const configPath = args[configFlagIndex + 1];
+        if (!configPath || configPath.startsWith('--')) {
+            console.error(pc.red('Error:') + ' --config requires a path argument');
+            console.error('  Example: npx create-aws-project setup-aws-envs --config aws.json');
+            process.exit(1);
+        }
+        await runSetupAwsEnvsNonInteractive(configPath);
+        return;
+    }
     // 1. Validate we're in a project directory
     const context = await requireProjectContext();
     const { config, configPath } = context;
     // 2. Check if already configured (warn but don't abort - allows retry after partial failure)
     const existingAccounts = config.accounts ?? {};
     const existingUsers = config.deploymentUsers ?? {};
+    const existingCredentials = config.deploymentCredentials ?? {};
     if (Object.keys(existingAccounts).length > 0) {
         console.log('');
         console.log(pc.yellow('Warning:') + ' AWS accounts already configured in this project:');
@@ -190,13 +521,74 @@ export async function runSetupAwsEnvs(_args) {
         console.log('');
         console.log(pc.dim('Continuing will skip existing accounts and create any missing ones...'));
     }
-    // 3. Collect emails (all input before any AWS calls - per research pitfall #6)
-    const emails = await collectEmails(config.projectName);
+    // 3. Detect root credentials and create admin user if needed
+    let adminCredentials = null;
+    if (config.adminUser) {
+        // Admin user already created in a previous run - skip root detection
+        console.log('');
+        console.log(pc.yellow('Note:') + ` Admin user ${pc.cyan(config.adminUser.userName)} already configured.`);
+        console.log(pc.dim('Using existing admin user. If you have switched to IAM credentials, root detection is skipped.'));
+    }
+    else {
+        // Check if current credentials are root
+        try {
+            const identity = await detectRootCredentials(config.awsRegion);
+            if (identity.isRoot) {
+                console.log('');
+                console.log(pc.yellow('Root credentials detected.'));
+                console.log('Creating admin IAM user for subsequent operations...');
+                console.log('');
+                // Create IAM client with current (root) credentials for management account
+                const iamClient = createIAMClient(config.awsRegion);
+                const adminResult = await createOrAdoptAdminUser(iamClient, config.projectName);
+                // Store admin credentials for use in this session
+                adminCredentials = {
+                    accessKeyId: adminResult.accessKeyId,
+                    secretAccessKey: adminResult.secretAccessKey,
+                };
+                // Persist admin user info to config (without secret key)
+                const configContent = JSON.parse(readFileSync(configPath, 'utf-8'));
+                configContent.adminUser = {
+                    userName: adminResult.userName,
+                    accessKeyId: adminResult.accessKeyId,
+                };
+                writeFileSync(configPath, JSON.stringify(configContent, null, 2) + '\n', 'utf-8');
+                if (adminResult.adopted) {
+                    console.log(pc.green(`Adopted existing admin user: ${adminResult.userName}`));
+                }
+                else {
+                    console.log(pc.green(`Created admin user: ${adminResult.userName}`));
+                }
+                console.log(pc.dim('Admin credentials will be used for all subsequent AWS operations in this session.'));
+                console.log('');
+            }
+        }
+        catch (error) {
+            // If STS call fails, let it propagate as an AWS error
+            // This likely means credentials are not configured at all
+            const spinner = ora('').start();
+            spinner.fail('Failed to detect AWS credentials');
+            handleAwsError(error);
+        }
+    }
     // 4. Execute AWS operations with progress spinner
     const spinner = ora('Starting AWS Organizations setup...').start();
     try {
         // Organizations API requires us-east-1 (region-locked per research pitfall #1)
-        const client = createOrganizationsClient('us-east-1');
+        // When admin credentials available, create OrganizationsClient with explicit credentials
+        let client;
+        if (adminCredentials) {
+            client = new OrganizationsClient({
+                region: 'us-east-1',
+                credentials: {
+                    accessKeyId: adminCredentials.accessKeyId,
+                    secretAccessKey: adminCredentials.secretAccessKey,
+                },
+            });
+        }
+        else {
+            client = createOrganizationsClient('us-east-1');
+        }
         // Check/create organization
         spinner.text = 'Checking for existing AWS Organization...';
         let orgId = await checkExistingOrganization(client);
@@ -208,12 +600,59 @@ export async function runSetupAwsEnvs(_args) {
         else {
             spinner.succeed(`Using existing AWS Organization: ${orgId}`);
         }
+        // Discover existing accounts from AWS (source of truth)
+        spinner.start('Checking for existing AWS accounts...');
+        const allOrgAccounts = await listOrganizationAccounts(client);
+        // Map accounts by environment using name pattern matching
+        const discoveredAccounts = new Map();
+        for (const account of allOrgAccounts) {
+            for (const env of ENVIRONMENTS) {
+                const expectedName = `${config.projectName}-${env}`;
+                if (account.Name === expectedName && account.Id) {
+                    discoveredAccounts.set(env, account.Id);
+                }
+            }
+        }
+        // Determine which environments still need account creation
+        const environmentsNeedingCreation = ENVIRONMENTS.filter(env => !discoveredAccounts.has(env));
+        // Report findings
+        for (const [env, accountId] of discoveredAccounts.entries()) {
+            spinner.info(`Found existing ${env} account: ${accountId}`);
+        }
+        // Warn if config has accounts not found in AWS
+        for (const [env, accountId] of Object.entries(existingAccounts)) {
+            if (!discoveredAccounts.has(env)) {
+                console.log(pc.yellow('Warning:') + ` Account ${env} (${accountId}) in config but not found in AWS Organization`);
+            }
+        }
+        spinner.stop();
+        // Collect emails only for environments that need account creation
+        let emails = {};
+        if (environmentsNeedingCreation.length > 0) {
+            // Must be outside spinner (prompts conflict with ora)
+            emails = await collectEmails(config.projectName, environmentsNeedingCreation);
+            spinner.start('Continuing AWS setup...');
+        }
+        else {
+            console.log('');
+            console.log(pc.green('All environment accounts already exist in AWS.'));
+            console.log(pc.dim('Skipping email collection, proceeding to deployment user setup...'));
+            console.log('');
+        }
         // Create accounts sequentially (per research - AWS rate limits require sequential)
+        // Start with accounts discovered from AWS (source of truth)
         const accounts = { ...existingAccounts };
+        for (const [env, accountId] of discoveredAccounts.entries()) {
+            accounts[env] = accountId;
+        }
+        // Update config with discovered accounts (sync config with AWS state)
+        if (discoveredAccounts.size > 0) {
+            updateConfig(configPath, accounts);
+        }
         for (const env of ENVIRONMENTS) {
-            // Skip if account already exists
-            if (existingAccounts[env]) {
-                spinner.succeed(`Using existing ${env} account: ${existingAccounts[env]}`);
+            // Skip if account already exists (in config OR discovered from AWS)
+            if (accounts[env]) {
+                spinner.succeed(`Using existing ${env} account: ${accounts[env]}`);
                 continue;
             }
             spinner.start(`Creating ${env} account (this may take several minutes)...`);
@@ -238,7 +677,29 @@ export async function runSetupAwsEnvs(_args) {
             const userName = `${config.projectName}-${env}-deploy`;
             const policyName = `${config.projectName}-${env}-cdk-deploy`;
             spinner.start(`Creating deployment user in ${env} account...`);
-            const iamClient = createCrossAccountIAMClient(config.awsRegion, accountId);
+            // When admin credentials available, create cross-account client with explicit credentials
+            let iamClient;
+            if (adminCredentials) {
+                // Use admin credentials as the source for role assumption
+                const roleArn = `arn:aws:iam::${accountId}:role/OrganizationAccountAccessRole`;
+                iamClient = new IAMClient({
+                    region: config.awsRegion,
+                    credentials: fromTemporaryCredentials({
+                        masterCredentials: {
+                            accessKeyId: adminCredentials.accessKeyId,
+                            secretAccessKey: adminCredentials.secretAccessKey,
+                        },
+                        params: {
+                            RoleArn: roleArn,
+                            RoleSessionName: `create-aws-project-${Date.now()}`,
+                            DurationSeconds: 900,
+                        },
+                    }),
+                });
+            }
+            else {
+                iamClient = createCrossAccountIAMClient(config.awsRegion, accountId);
+            }
             await createOrAdoptDeploymentUser(iamClient, userName);
             spinner.text = `Creating deployment policy for ${env}...`;
             const policyArn = await createCDKDeploymentPolicy(iamClient, policyName, accountId);
@@ -248,18 +709,95 @@ export async function runSetupAwsEnvs(_args) {
             updateConfig(configPath, accounts, deploymentUsers);
             spinner.succeed(`Created deployment user: ${userName}`);
         }
+        // Create access keys for deployment users
+        const deploymentCredentials = {};
+        for (const env of ENVIRONMENTS) {
+            // Skip if credentials already exist in config
+            if (existingCredentials[env]) {
+                spinner.succeed(`Using existing credentials for ${env}: ${existingCredentials[env].accessKeyId}`);
+                deploymentCredentials[env] = existingCredentials[env];
+                continue;
+            }
+            const userName = deploymentUsers[env];
+            spinner.start(`Creating access key for ${env} deployment user...`);
+            // Use the same cross-account IAM client pattern as deployment user creation
+            const accountId = accounts[env];
+            let iamClient;
+            if (adminCredentials) {
+                const roleArn = `arn:aws:iam::${accountId}:role/OrganizationAccountAccessRole`;
+                iamClient = new IAMClient({
+                    region: config.awsRegion,
+                    credentials: fromTemporaryCredentials({
+                        masterCredentials: {
+                            accessKeyId: adminCredentials.accessKeyId,
+                            secretAccessKey: adminCredentials.secretAccessKey,
+                        },
+                        params: {
+                            RoleArn: roleArn,
+                            RoleSessionName: `create-aws-project-${Date.now()}`,
+                            DurationSeconds: 900,
+                        },
+                    }),
+                });
+            }
+            else {
+                iamClient = createCrossAccountIAMClient(config.awsRegion, accountId);
+            }
+            const credentials = await createAccessKey(iamClient, userName);
+            deploymentCredentials[env] = {
+                userName,
+                accessKeyId: credentials.accessKeyId,
+                secretAccessKey: credentials.secretAccessKey,
+            };
+            // Save after EACH successful key creation (partial failure resilience)
+            updateConfig(configPath, accounts, deploymentUsers, deploymentCredentials);
+            spinner.succeed(`Created access key for ${userName}`);
+        }
+        // Bootstrap CDK in each environment account
+        await bootstrapAllEnvironments({
+            accounts,
+            region: config.awsRegion,
+            adminCredentials,
+            spinner,
+        });
         // Final success with summary table
         console.log('');
         console.log(pc.green('AWS environment setup complete!'));
         console.log('');
         console.log('Summary:');
-        console.log(`  ${'Environment'.padEnd(14)}${'Account ID'.padEnd(16)}Deployment User`);
+        console.log(`  ${'Environment'.padEnd(14)}${'Account ID'.padEnd(16)}${'Deployment User'.padEnd(30)}Access Key`);
         for (const env of ENVIRONMENTS) {
-            console.log(`  ${env.padEnd(14)}${accounts[env].padEnd(16)}${deploymentUsers[env]}`);
+            const keyId = deploymentCredentials[env]?.accessKeyId ?? 'N/A';
+            console.log(`  ${env.padEnd(14)}${accounts[env].padEnd(16)}${deploymentUsers[env].padEnd(30)}${keyId}`);
         }
         console.log('');
-        console.log('Deployment users created. Next: initialize-github to create access keys and push to GitHub.');
-        console.log(`  ${pc.cyan('npx create-aws-project initialize-github dev')}`);
+        console.log(pc.dim('CDK bootstrapped in all environment accounts.'));
+        console.log('');
+        console.log('AWS setup complete. All environments bootstrapped and ready for CDK deployments.');
+        console.log('');
+        // Offer continuation to GitHub setup
+        const continueResponse = await prompts({
+            type: 'confirm',
+            name: 'continueToGitHub',
+            message: 'Continue to GitHub Environment setup?',
+            initial: true,
+        }, {
+            onCancel: () => {
+                // User pressed Ctrl+C — show next step hint and exit gracefully
+                console.log('');
+                console.log('Next: Push credentials to GitHub:');
+                console.log(`  ${pc.cyan('npx create-aws-project initialize-github --all')}`);
+            },
+        });
+        if (continueResponse.continueToGitHub) {
+            console.log('');
+            await runInitializeGitHub(['--all']);
+        }
+        else {
+            console.log('');
+            console.log('Next: Push credentials to GitHub:');
+            console.log(`  ${pc.cyan('npx create-aws-project initialize-github --all')}`);
+        }
     }
     catch (error) {
         spinner.fail('AWS setup failed');