Does AWS CDK satisfy FCA PS21/3 change management requirements?

AWS CDK + CloudFormation satisfies FCA PS21/3 change management: (1) CDK generates CloudFormation templates (every infrastructure change produces a CloudFormation change set — reviewed before apply), (2) CloudFormation change set = audit record (who requested, what changes, when applied — immutable in CloudFormation history), (3) CloudFormation stack drift detection (detects manual changes outside CDK — important for PS21/3 controlled change management), (4) AWS Config compliance rules (CDK-deployed infrastructure continuously assessed against compliance rules — evidence for FCA PS21/3 technical resilience). ClickMasters configures branch protection on CDK code + CloudFormation change set approval as the FCA PS21/3 change management process.

When should UK teams use Terraform instead of AWS CDK?

Terraform wins when: (1) multi-cloud (if AWS + Azure — Terraform manages both, CDK is AWS-only), (2) existing Terraform state (migrating to CDK mid-project is painful — Terraform import is easier), (3) team expertise (if team is proficient in Terraform HCL and unfamiliar with TypeScript — CDK has a learning curve), (4) Terragrunt (DRY Terraform with Terragrunt is well-established — CDK equivalent requires custom patterns). ClickMasters Terraform use case: NHS Landing Zone (AWS + Azure hybrid NHS requirements), enterprise clients with existing Terraform state, and multi-account AWS organisations using Terraform Cloud. CDK for all greenfield UK projects.

Terraform Vs Cdk Vs Pulumi Uk Iac 2026

Terraform vs AWS CDK vs Pulumi — UK Infrastructure as Code (2026)

Updated: February 20269 min read

🇬🇧 UK💷 GBP📊 Comparison🔒 UK GDPR⚖️ UK Law

Direct Answer

AWS CDK (TypeScript) is ClickMasters' default for all new UK AWS projects — same TypeScript codebase as application code, best-in-class AWS integration, and Cyber Essentials patching evidence via CloudFormation change sets. Terraform is right when the team needs multi-cloud IaC (AWS + Azure), or when the team already has deep Terraform expertise. Pulumi is right for Python-heavy teams who prefer Python IaC over TypeScript. IaC framework choice affects UK GDPR infrastructure audit trail, Cyber Essentials patching evidence, and developer productivity.

Factor	AWS CDK (TypeScript)	Terraform (HCL)	Pulumi (Python/TypeScript)
UK GDPR audit trail (infra changes)	✅ CloudFormation change sets — immutable	Terraform state + plan — good	Pulumi state + preview — good
Cyber Essentials patching evidence	✅ CloudFormation stack drift detection	terraform plan drift detection	Pulumi stack refresh
FCA PS21/3 change management	✅ CloudFormation change set = audit of every infra change	Terraform plan approved then applied	Pulumi preview approved then applied
NHS DTAC Domain 3 evidence	✅ CloudFormation creates compliance reports (AWS Config)	Manual compliance mapping	Manual compliance mapping
Language	TypeScript — same as application	HCL (HashiCorp Configuration Language)	Python or TypeScript
Multi-cloud (AWS + Azure)	AWS-only	✅ Multi-cloud — all major providers	✅ Multi-cloud
AWS service coverage	✅ Constructs Library — all AWS services	AWS provider — all services	AWS provider — all services
ClickMasters default	✅ All new UK AWS projects	Multi-cloud or Terraform-expert team	Python-heavy teams