AWS Proton
A managed delivery service that enables developers to deploy services without worrying about infrastructure, based on templates defined by platform teams
Overview
AWS Proton is a fully managed service where platform engineering teams define and manage infrastructure templates (environment templates and service templates), and developers deploy applications simply by selecting those templates. Using CloudFormation or Terraform as backends, it version-controls infrastructure configurations such as VPC, ECS, and Lambda as templates. When templates are updated, it controls bulk application to existing deployed services and rollback, balancing infrastructure standardization and governance across the organization.
Designing Environment Templates and Service Templates
Proton's template system is a two-layer structure: environment templates defining shared infrastructure and service templates defining application-specific resources. Environment templates describe foundational resources shared by multiple services such as VPCs, subnets, ALBs, and ECS clusters, while service templates describe per-application resources such as ECS task definitions, Lambda functions, and API Gateway endpoints. Templates are managed with semantic versioning (major.minor), where minor version updates are automatically applied to existing services and major version updates require explicit developer approval. Template input parameters clearly separate items exposed to developers (instance size, environment variables, etc.) from items fixed by the platform team (security groups, IAM policies, etc.), enabling precise control over the balance between developer freedom and governance.
Self-Service Deployment and CI/CD Pipeline Integration
Developers select a service template from the Proton console or CLI, enter a few parameters, and infrastructure and application deployment completes. CodePipeline integration enables embedding automated deployment pipelines triggered by Git repository pushes into templates. Integration with external CI/CD tools like GitHub Actions and GitLab CI is also possible, calling Proton APIs to report deployment status. The service instance concept enables deploying the same service to development, staging, and production environments with individual parameters, managing configuration differences between environments at the template parameter level. All deployment history is recorded in Proton, automatically maintaining audit trails of which template version was applied when.
Terraform Support and Platform Engineering in Practice
Proton supports Terraform in addition to CloudFormation as a provisioning engine. Terraform support uses a self-managed provisioning mechanism that executes terraform apply on CodeBuild, allowing existing Terraform module assets to be incorporated directly into Proton templates. In the platform engineering context, Proton functions as a core component of an Internal Developer Platform (IDP). API integration with developer portals like Backstage enables architectures where Proton provisions infrastructure behind the scenes when developers create services from the portal. Incorporating template review and approval flows ensures only templates that have passed security team pre-review are available, also helping suppress shadow IT.