Platform Engineering — Self-Service Provisioning for AWS

What is this?

This form fires the AWS - Provision & Reconcile Application Resources GitHub Actions workflow on this repository via the repository_dispatch trigger. The workflow runs the full pipeline: Terraform plan + apply against AWS, and — when an Application template repo is provided — GitHub Environments + variables on the application repo, an OIDC trust subject on the platform IAM role, and (on first creation) observation of the application's CI workflow.

Leave Application template repo empty to run in infra-only mode: only AWS resources are provisioned; no application repository is created or configured. Useful for Landing Zones and foundational platform components.

Everything you fill below maps 1:1 to a workflow input. The page never persists your token; it stays in your browser memory only for the lifetime of the page.

What gets provisioned

Per environment requested, Terraform creates:

VPC with two public and two private subnets across two AZs, internet gateway, route tables
NAT gateway — one shared in dev/staging, one per AZ in prod
VPC flow logs to CloudWatch (30 / 60 / 90-day retention by environment)
Application Load Balancer, HTTPS listener on a TLS 1.3-only policy, HTTP listener redirecting to HTTPS
ACM certificate for <app>.<env>.<main-domain>, DNS-validated, plus its Route 53 record
ECS Fargate cluster <app>-<env> with Container Insights, and a service of the same name
Task definition sized per environment (0.25 vCPU / 512 MB dev, 0.5 / 1024 staging, 1 / 2048 prod)
Two security groups (ALB and tasks) and a locked-down default security group
Task execution and task IAM roles, least-privilege scoped
CloudWatch log groups, metric alarms and X-Ray tracing (100% sampling dev, 10% staging, 1% prod)
Application Auto Scaling on CPU and memory (1–3 staging, 3–10 prod; fixed single task in dev)
CodeDeploy application and deployment group for blue/green deploys (staging and prod)

When an application template repo is provided: the app repo from the template, GitHub Environments + variables, the OIDC trust subject per env, and a tracking issue summarising the run. This phase is skipped when no application template is given.

Configuration applied

Security: HTTPS with a TLS 1.3-only ALB policy in every environment (enforced by a validation rule, not just a default), tasks in private subnets with no public IPs, egress via NAT, TLS terminating at the ALB.
Compliance (Checkov): all CKV_AWS_* checks pass; per-env strictness via .checkov.yaml (prod) and .checkov.nonprod.yaml (dev/staging).
Resilience: prod runs a 3-task baseline across two AZs with a NAT gateway per AZ and ALB deletion protection; staging and prod deploy blue/green through CodeDeploy.
Observability: CloudWatch log groups per component, Container Insights, metric alarms, and X-Ray traces sampled per environment.
State: Terraform state in an S3 bucket per app (tf-state-<app>-<account8>), encrypted, public access blocked, OIDC for the backend.

Request parameters

Application name * 3–22 chars, lowercase + digits + hyphens, no leading/trailing hyphen.

Must match ^[a-z0-9][a-z0-9-]{1,20}[a-z0-9]$.

Environment * Which environment(s) to provision/reconcile in this run.

Required.

AWS region * Region for the resources and the Terraform state bucket. No default — must be set explicitly.

Lowercase region code, e.g. eu-west-1.

IAM role ARN * Role assumed via OIDC. Its account ID also names the state bucket.

Must be a full IAM role ARN, e.g. arn:aws:iam::123456789012:role/GitHubActionsRole.

Root domain * Existing Route 53 hosted zone in the same account. The certificate is issued for <app>.<env>.<domain>.

Must be a domain name, e.g. example.com.

Infrastructure template repo * Infrastructure archetype: Terraform modules + Checkov configs. owner/name.

Format must be owner/name.

Infrastructure template ref (optional) Tag, branch or commit SHA pinning the infra template. Default: its default branch.

Application template repo (optional) Source for the new application repo. owner/name. Leave empty for infra-only provisioning.

Format must be owner/name.

Application template ref (optional) Tag, branch or commit SHA pinning the app template. Default: its default branch.

Container image (optional) Ignored on reconcile runs. The workflow's reference image is used if blank. Include the registry host in the reference — ECS pulls by full image reference, so there is no separate registry field. The archetype fixes the container contract — port 8080, health endpoint /health; implementing apps must follow it.

CI workflow file (optional) Filename inside the application repo. Default ci.yml.

Platform repo * This repo (auto-detected from the page URL).

Format must be owner/name.

GitHub token * Fine-grained PAT with Contents: write on this repo (or classic repo scope). Kept in browser memory only.

Required.

Preview — equivalent `curl`

# Fill the form above to see the curl preview

What is this?

What gets provisioned

Configuration applied

Request parameters

Preview — equivalent curl

Preview — equivalent `curl`