How are you building self-service AWS infrastructure without Control Tower?

Tools focused on developer environments can help with temporary infrastructure, but they don’t necessarily solve complete AWS account vending or production IaC. For broader self-service, I’d separate the user-facing catalog from the provisioning engine and expose only well-tested Terraform modules or workflows with guardrails.

A practical pattern is to put a request form in front of your automation. The request can create a preconfigured issue or change request, which then feeds a Terraform pipeline. That gives teams a self-service experience while still keeping the actual infrastructure changes reviewed, version-controlled, and applied through IaC.

GitOps paired with Atlantis is a solid approach. Teams submit infrastructure changes through pull requests, Atlantis runs the Terraform plans and applies approved changes, and the repository remains the source of truth. You can add policy checks and approval rules for account creation or higher-risk resources.

We use a thin CLI around a bootstrap deployment. The first CloudFormation stack creates the build project and other required plumbing, then a second deployment uploads the organization’s IaC modules to object storage and runs the build. It hides the implementation details from users while keeping the provisioning process standardized and repeatable.

Backstage can provide the catalog and request experience, but most of the effort is in building the automation behind each template. The templates can collect the required inputs, create a repository or change request, and trigger Terraform or another approved deployment pipeline.