awscdk cfnPractitioner

Streamline Your AWS CDK Constructs with Property Injection

5 min read AWS DevOps BlogMar 5, 2026Reviewed for accuracy

Practitioner — Hands-on experience recommended

In the world of AWS CDK, repetitive configuration can lead to mistakes and maintenance headaches. Property Injection exists to solve this problem by intercepting construct creation and automatically applying organizational defaults. This means you can focus on the unique aspects of your infrastructure while ensuring that standard policies are consistently enforced across your constructs.

How does it work? Property Injection operates transparently within the CDK framework. When you create a construct, it merges your explicitly provided properties with predefined defaults. For example, if you define a SecurityGroup without specifying security policies, Property Injection will automatically apply those defaults for you. This reduces boilerplate and ensures compliance with your organization's security standards.

In practice, using Property Injection can significantly streamline your code. You can define default properties for specific construct types by implementing the IPropertyInjector interface. This allows you to maintain a clean codebase while ensuring that all necessary configurations are applied. However, be aware that this feature was introduced in AWS CDK v2.196.0, so ensure your environment is up to date to take advantage of it.

Key takeaways

→Implement IPropertyInjector to define default properties for constructs.
→Leverage Property Injection to reduce repetitive configuration in your CDK code.
→Ensure your AWS CDK version is v2.196.0 or later to utilize Property Injection.

Why it matters

In production, consistent application of security policies can prevent vulnerabilities. Property Injection helps enforce these standards automatically, reducing the risk of human error.

Code examples

TypeScript

new SecurityGroup(stack, 'api-sg', {
  vpc: myVpc,
  allowAllOutbound: false,        // Required by security policy
  allowAllIpv6Outbound: false     // Required by security policy
});

TypeScript

// Your existing code remains unchanged
new SecurityGroup(stack, 'my-sg', {
  vpc: myVpc
  // Security defaults applied automatically by Property Injection
});

TypeScript

import { IPropertyInjector, InjectionContext } from 'aws-cdk-lib';
import { SecurityGroup, SecurityGroupProps } from 'aws-cdk-lib/aws-ec2';

export class SecurityGroupDefaults implements IPropertyInjector {
  readonly constructUniqueId: string