Tarmac CLI (tarmac-cli)

Tarmac is a declarative, idempotent Python CLI for bootstrapping and governing enterprise multi-account AWS Organizations.

Define your organizational units, account factory, SCP guardrails, baseline security (CloudTrail, GuardDuty, Security Hub), and IAM Identity Center (SSO) in simple YAML manifests—then reconcile your entire AWS estate with a single command.

Quickstart

1. Installation & Setup

Install from source with uv:

git clone https://github.com/nickdchristian/tarmac-cli.git
cd tarmac-cli
uv sync

You can then run commands with uv run tarmac or install it into your local environment:

uv pip install -e .
tarmac --help

(Once published to PyPI, you can install globally with uv tool install tarmac-cli)

2. Initialize Configuration

Scaffold a production-ready starter project with baseline YAML manifests and CloudFormation templates:

tarmac init --with-templates

This generates:

• config/organization.yaml: Organization settings, alternate contacts, OU hierarchy, and SCP guardrails.
• config/accounts.yaml: Account Factory catalog, OU placement, monthly budgets, and security baselines.
• config/identity.yaml: IAM Identity Center permission sets, users, groups, and multi-account assignments.

3. Validate & Inspect Readiness

Verify your configurations and audit your AWS Management Account before deploying:

# Validate YAML syntax, Pydantic schemas, and cross-references
tarmac validate

# Run 17 automated pre-flight readiness checks (MFA, quotas, contacts, hygiene)
tarmac preflight

4. Deploy Your Landing Zone

Preview proposed actions with a dry run, then execute the automated rollout:

# Preview what will be created and configured
tarmac deploy run --dry-run

# Execute the full 6-phase deployment pipeline
tarmac deploy run

Deployment Pipeline

Tarmac executes an idempotent multi-phase deployment:

[Phase 0: Preflight]   ──► Validate AWS prerequisites, quotas, & credentials
[Phase 1: Org & Root]  ──► Bootstrap AWS Organizations, contacts, & root access
[Phase 2: OUs & SCPs]  ──► Idempotently sync OU tree & attach guardrail SCPs
[Phase 3: Central Log] ──► Deploy Log-Archive bucket & Org-wide CloudTrail
[Phase 4: Accounts]    ──► Provision member accounts, purge default VPCs, set budgets
[Phase 5: Hardening]   ──► Delegate Security Hub / GuardDuty & anomaly monitors
[Phase 6: Identity]    ──► Sync IAM Identity Center permission sets & assignments

You can target a specific phase at any time:

tarmac deploy run --phase 4   # Run only Account Factory provisioning

Command Reference

Safe Teardown

Tarmac includes built-in safeguards to prevent accidental infrastructure or state loss:

• Production Environment Lock: Refuses to destroy any environment tagged with production or prod unless --force is explicitly provided.
• Remote State Preservation: Pass --preserve-backend to destroy infrastructure while protecting remote Terraform state buckets and lock tables.
• Non-Empty Bucket Protection: Halts if unmanaged data exists in S3 buckets unless explicitly confirmed.

# Preview teardown actions
tarmac deploy destroy --dry-run

# Execute teardown preserving Terraform state
tarmac deploy destroy --preserve-backend

Development & Testing

# Sync environment dependencies
uv sync

# Run the 247-test Pytest suite
uv run pytest

# Run static analysis and formatting
uv run ruff check .
uv run ruff format --check .
uv run basedpyright

License

Licensed under the Apache License, Version 2.0.