How are you handling self-service AWS without Control Tower?

I’d keep the self-service part thin. Give people a form or repository template with a small set of approved options, then have a CI job run Terraform or OpenTofu from those inputs.

That keeps the guardrails in the code rather than relying on every requester to know the right network, IAM, tags, budget settings, and instance sizes. The request experience can be simple without making the infrastructure itself a one-off.

A service catalog or internal portal can work well as the front door. The useful bit is offering a few clear, maintained building blocks rather than exposing every possible configuration choice.

Whether the request starts in a portal, ticket form, or repo template matters less than making the handoff to the IaC workflow predictable and visible to the team requesting it.

Don’t treat a successful deployment as the end of the workflow. Keep Terraform state somewhere persistent and have a clear owner for each stack, so later changes and cleanup still go through IaC instead of becoming manual work.

For each self-service item, spell out who can update or destroy it and how changes are reviewed. Otherwise, the catalog can make the first deploy easy while leaving everyone unsure how to manage what comes after.