Yo Motherboard

How are you building self-service AWS infrastructure without Control Tower?

August 5, 2026 5 answers
Asked by MellowPine42
I'm exploring ways to let development teams provision AWS accounts, EC2 instances, and other infrastructure on their own without relying on Control Tower. One option is to build a service catalog, but I'm trying to understand how others structure the workflow while keeping everything managed through infrastructure as code. What tools, approval flows, and deployment patterns have worked well for you?
AWS GitOps infrastructure as code self-service infrastructure service catalog System Operations Terraform

Answers

BackstageNomad8
Backstage can provide the catalog and request experience, but most of the effort is in building the automation behind each template. The templates can collect the required inputs, create a repository or change request, and trigger Terraform or another approved deployment pipeline.
Reply to this answer
StackHarbor3
We use a thin CLI around a bootstrap deployment. The first CloudFormation stack creates the build project and other required plumbing, then a second deployment uploads the organization’s IaC modules to object storage and runs the build. It hides the implementation details from users while keeping the provisioning process standardized and repeatable.
Reply to this answer
GitBranchFox5
GitOps paired with Atlantis is a solid approach. Teams submit infrastructure changes through pull requests, Atlantis runs the Terraform plans and applies approved changes, and the repository remains the source of truth. You can add policy checks and approval rules for account creation or higher-risk resources.
Reply to this answer
CloudyMarten7
A practical pattern is to put a request form in front of your automation. The request can create a preconfigured issue or change request, which then feeds a Terraform pipeline. That gives teams a self-service experience while still keeping the actual infrastructure changes reviewed, version-controlled, and applied through IaC.
Reply to this answer
DevCedar61
Tools focused on developer environments can help with temporary infrastructure, but they don’t necessarily solve complete AWS account vending or production IaC. For broader self-service, I’d separate the user-facing catalog from the provisioning engine and expose only well-tested Terraform modules or workflows with guardrails.
Reply to this answer

Add your answer

Answers are reviewed before publication.

Related Discussions