The problem

Every new service shouldn’t start with a two-week ticket queue, and it shouldn’t start with a copy-pasted template that’s already out of date. Platform engineering paves the road: the platform team encodes best practice once, and developers self-serve it in minutes, without needing broad IAM permissions.

What you’ll build

• A shared runtime (VPC + ECS cluster with Container Insights) published through SSM parameters
• A Service Catalog portfolio of golden paths built as CDK ProductStacks
• Golden path #1: container web service (immutable ECR repo with scanning, Fargate service, ALB, circuit-breaker rollback, autoscaling, 5xx alarm)
• Golden path #2: serverless REST API (HTTP API, Lambda with tracing, DynamoDB with PITR, throttling, error alarm)
• A launch role and TagOptions so developers need no infrastructure permissions and every resource is tagged

Architecture

Platform team (this CDK app)                      Developer
──────────────────────────────                   ─────────
VPC + ECS cluster (shared runtime)               Service Catalog console / CLI / Backstage
SSM params: /idp/vpc-id, /idp/cluster-name   ──▶  "Container web service v1"  ──▶ ECR + Fargate + ALB + alarms
Service Catalog portfolio "Golden Paths"          "Serverless REST API v1"    ──▶ HTTP API + Lambda + DynamoDB
Launch role (least privilege, no IAM users)       TagOptions enforce cost-center + environment

AWS services used

How it works

1. PublishThe platform team deploys one CDK app that creates the runtime and the catalog.
2. Self-serveA developer launches a product from the console, CLI, GitHub Actions or Backstage.
3. Comply by defaultLogs, alarms, scanning, tagging and rollbacks come with the product. Nobody has to remember them.
4. EvolveShip v2 of a golden path, and teams upgrade with one command. Improvements roll out as versions, not tickets.

Key design decisions

• ProductStacks let golden paths be real CDK code, not hand-written YAML.
• SSM parameters act as a stable contract between platform and products.
• The launch role explicitly denies IAM users and access keys, so golden paths can’t create long-lived credentials.

Deploy it

npm install
npx cdk deploy -c developerRoleArn=arn:aws:iam::123456789012:role/AWSReservedSSO_Developer_abc123

Full prerequisites, parameters and clean-up steps are in the project README on the code page.

See it work

Launch “Container web service” with the name orders-api. About eight minutes later you have a load-balanced, autoscaled, monitored service URL and an ECR repo, and you didn’t write any infrastructure code.

Skills this demonstrates