Enterprise Infrastructure Self-Service with AAP + Terraform

When application teams asked for infrastructure through tickets and manual provisioning, delivery was slow, results varied from one engineer to another, and it was hard to prove every resource met the same standards.

The platform team handles a steady flow of 30–40 infrastructure requests and incidents each week. Many requests are repeatable: EC2 instances, IAM roles and policies, ALB target groups and other approved AWS services.

1. 1.Identified the repeatable request types and turned each into a standardized input contract.
2. 2.Put provisioning logic in reusable Terraform modules, so every request produces the same shape of resource.
3. 3.Used AAP job templates and surveys as the front door, which gives teams a consistent interface and gives the platform team role-based control over who can run what.
4. 4.Integrated AAP with Terraform Enterprise, so runs are logged and auditable.

• ▸Inputs are constrained and validated, and teams cannot pass arbitrary resource definitions.
• ▸Credentials are stored and injected by the platform instead of being handled by requesters.
• ▸IAM guardrails and approved-service lists bound what can be provisioned.
• ▸Internal survey names, role names, accounts and policies are deliberately omitted here.

• ▸Request-to-resource workflow with no manual console steps.
• ▸Reusable modules shared across request types.
• ▸Remote state enables safe updates and teardown.

• ▸Routine provisioning moved from manual work to a repeatable self-service path.
• ▸Resources are created consistently from the same reviewed modules.
• ▸Engineering time shifted from repetitive requests toward platform improvements.

• ▸A narrow, well-validated input contract matters more than a flexible one.
• ▸Self-service only scales when guardrails are enforced by the platform, not by reviewers.