diff --git a/.github/workflows/cdk-deploy.yml b/.github/workflows/cdk-deploy.yml
new file mode 100644
index 0000000..d24b821
--- /dev/null
+++ b/.github/workflows/cdk-deploy.yml
@@ -0,0 +1,64 @@
+name: CDK Deploy
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'cdk/**'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'cdk/**'
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  cdk-deploy:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: cdk
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+          cache-dependency-path: 'cdk/requirements*.txt'
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install CDK CLI
+        run: npm install -g aws-cdk
+
+      - name: Install Python dependencies
+        run: pip install -r requirements.txt
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}
+
+      - name: CDK Synth
+        run: cdk synth
+
+      - name: CDK Diff
+        if: github.event_name == 'pull_request'
+        run: cdk diff
+
+      - name: CDK Deploy
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: cdk deploy --all --require-approval never
diff --git a/cdk/app.py b/cdk/app.py
index ab677d9..fad39d1 100644
--- a/cdk/app.py
+++ b/cdk/app.py
@@ -3,9 +3,9 @@
 
 import aws_cdk as cdk
 
-from cdk.cdk.ecr_stack import EcrStack
-from cdk.cdk.ecs_stack import EcsStack
-from cdk.cdk.lambda_stack import LambdaStack
+from cdk.ecr_stack import EcrStack
+from cdk.ecs_stack import EcsStack
+from cdk.lambda_stack import LambdaStack
 
 app = cdk.App()
 
diff --git a/cdk/cdk/ecs_stack.py b/cdk/cdk/ecs_stack.py
index 9ee4400..8da8fe3 100644
--- a/cdk/cdk/ecs_stack.py
+++ b/cdk/cdk/ecs_stack.py
@@ -6,7 +6,7 @@
     aws_ecr as ecr,
 )
 
-from config import Config
+from cdk.config import Config
 from constructs import Construct
 
 class EcsStack(Stack):
@@ -63,7 +63,7 @@ def __init__(self, scope: Construct, construct_id: str, ecr_repository: ecr.IRep
 
         vpc.add_interface_endpoint(
             "ECRApiEndpoint",
-            service=ec2.InterfaceVpcEndpointAwsService.ECR_API,
+            service=ec2.InterfaceVpcEndpointAwsService.ECR,
             security_groups=[endpoint_security_group]
         )
 
diff --git a/cdk/cdk/lambda_stack.py b/cdk/cdk/lambda_stack.py
index 5510056..67c9bcc 100644
--- a/cdk/cdk/lambda_stack.py
+++ b/cdk/cdk/lambda_stack.py
@@ -9,7 +9,7 @@
     Duration
 )
 
-from config import Config
+from cdk.config import Config
 from constructs import Construct
 
 class LambdaStack(Stack):
@@ -29,7 +29,7 @@ def __init__(self, scope: Construct, construct_id: str,
             self, "DistributedPathTracerFunction",
             function_name="DistributedPathTracerFunction",
             architecture=_lambda.Architecture.X86_64,
-            code=_lambda.EcrImageCode.from_ecr(ecr_repository, tag_or_digest="preprocessor-latest"),
+            code=_lambda.EcrImageCode.from_ecr_image(ecr_repository, tag_or_digest="preprocessor-latest"),
             handler=_lambda.Handler.FROM_IMAGE,
             runtime=_lambda.Runtime.FROM_IMAGE,
             memory_size=1024,