To build an internal developer platform (IDP) on AWS that developers actually use, start with a recurring developer problem—not a portal rollout or a mandate to adopt a particular cloud abstraction. Treat the platform as an internal product, deliver one complete self-service path that removes real friction, and improve it from developer feedback and operational outcomes. AWS documents several ways to host and assemble platform capabilities; none is a universal required stack.
What should an AWS internal developer platform do?
An IDP is a product and service for the organization’s developers. Its job is to make useful, supported ways of building and operating software easier to discover and use. A developer portal can provide the front door, but the platform also depends on the automation, infrastructure, security controls, delivery workflows and operational capabilities behind that interface.
That distinction matters: launching a catalog or portal alone does not remove the work of provisioning environments, deploying services, finding ownership information or applying security controls. AWS guidance describes the portal as one component connecting platform capabilities, not as the platform itself.
How do you find a first problem worth solving?
Start by examining how teams work today. Inventory existing tools, systems and processes, and look for repeated tasks or confusing handoffs that add cognitive load. Depending on the organization, friction might arise during environment setup, access requests, deployment, service discovery, debugging or the application of security requirements. Do not assume which one is most painful: confirm it with the developers who encounter it.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
Choose one journey where a platform capability can remove a meaningful obstacle. “Create and deploy a service” is a useful candidate when teams repeat the same setup and delivery work, but the right starting point depends on local needs. Keep the first scope narrow enough to deliver and support, yet complete enough to solve the chosen job rather than merely expose another tool.
What does the platform team need to own?
Platform engineering combines product decisions with technical delivery. AWS’s preparation guidance identifies several skill areas the team needs collectively:
- Development: build interfaces and abstractions developers can use.
- Operations: provide dashboards, metrics and alerts for platform services.
- Automation and infrastructure as code: create repeatable golden paths.
- Security: incorporate scanning and policy-as-code into those paths.
The team also needs a feature roadmap. Prioritize work against developer requirements rather than the novelty of a technology, and make feedback part of the operating loop: listen to users, ship a capability, observe its use and outcomes, then adjust the roadmap. Ownership should include the ongoing support and improvement of what the team exposes, not just its initial implementation.
What should the first golden path automate?
A golden path is a reusable, recommended pattern that helps a team complete a task without having to assemble every implementation detail itself. For a service-creation journey, AWS examples describe automating repository setup, testing, deployment and observability. Add security checks and policy controls that fit the organization’s standards where they belong in that flow.
Keep the developer-facing inputs to the minimum the automation genuinely needs. The value is not in concealing every decision; it is in avoiding repeated choices and manual steps that the platform can safely handle. AWS guidance cautions against trying to automate every stage of the software development lifecycle at the beginning. Get one useful path working, learn where users still encounter friction, and expand only when there is a clear need.
Security should be part of the path, not a separate instruction developers must remember after the fact. AWS capability examples include infrastructure linting and security checks, policy checks, software composition analysis, static and dynamic application security testing, artifact scanning, secrets scanning and runtime protection. These are examples, not a mandatory tool list or endorsement. Select controls using the organization’s threat model and compliance requirements.
Rank #3
How should you design the AWS architecture?
AWS describes deploying an IDP in a shared-services or tooling account with access to workload accounts. This is one way to centralize platform management and improve cost visibility while application teams use separate accounts for their environments. The platform still needs clear identity, tenancy and permission boundaries, as well as the delivery and operational capabilities developers depend on.
AWS lists both Amazon ECS and Amazon EKS as hosting options for platform components. It also describes Backstage as a possible developer portal. Neither choice is a requirement: the portal is only one layer, and hosting should follow workload needs, team skills and operational ownership.
| Capability | AWS guidance examples | What the platform team must decide |
|---|---|---|
| Developer portal | Backstage | How the portal connects to supported workflows and keeps service information useful. |
| Identity | IAM Identity Center or Amazon Cognito | How users authenticate and how access is bounded across platform and workload environments. |
| Infrastructure as code | CloudFormation or AWS CDK | Which approach fits the organization’s delivery workflow and how infrastructure changes are checked. |
| Delivery | AWS CodePipeline or repository and workflow tools | How teams build, test, promote and deploy changes within their existing development practices. |
| Artifacts and secrets | Amazon ECR or CodeArtifact; AWS Secrets Manager | How artifacts and secrets are managed and made available through the appropriate controls. |
| Observability | Amazon CloudWatch, AWS X-Ray, Amazon Managed Service for Prometheus or Amazon Managed Grafana | Which telemetry developers need and how they use it to understand service behavior. |
| Platform hosting | Amazon ECS or Amazon EKS | Which operating model the platform team can support for its workloads. |
This is a set of capability examples, not a bill of materials. Choosing a service does not by itself integrate identity, delivery, security and observability into a usable developer journey. Those connections, along with tenancy and secure ingress, are part of the platform design.
Should you use EKS, ECS or a serverless path?
Compare paths against the workloads and the team that will operate them rather than treating one compute model as the default for every application. AWS examples cover serverless, ECS and EKS paths. The guidance provides examples, not a complete workload-by-workload cost comparison.
| Path | Elements named in AWS examples | What to evaluate |
|---|---|---|
| EKS | Helm packaging; Argo CD for GitOps deployment; AWS Load Balancer Controller; external-secrets integration; policy controls; Karpenter for cluster autoscaling; and managed Prometheus and Grafana for observability. | Whether the workload needs this Kubernetes-oriented path, whether the team can operate and support it, and how its control, tenancy, deployment and observability needs fit the organization. |
| ECS | Fargate and CloudWatch Container Insights. | Whether this path fits the workload and the operational model the organization wants its platform team to own. |
| Serverless | Included as an example path; the cited example does not specify a comparable component list here. | Whether the workload fits a serverless approach and which implementation details the platform team will standardize. |
For any two paths under consideration, make the comparison concrete: workload shape and runtime requirements, existing team skills, desired abstraction and control, security and tenancy boundaries, deployment and rollback needs, observability and cost visibility, and the platform team’s ability to operate the result. Avoid choosing EKS simply because it is familiar or choosing a more abstract path without checking whether it fits the workload.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do you make self-service usable?
Expose the path through the interface that fits developer workflows. AWS identifies a graphical interface, API or command-line interface as possible ways to provide self-service. Whichever you offer, make the supported journey easy to find and avoid making users learn the underlying platform implementation just to get started.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteBest Value
Documentation should help developers contribute, understand service dependencies and follow golden paths. It should not make a tour of the underlying EKS cluster or account-baselining process a prerequisite for using the platform. Let teams adopt individual capabilities while the broader platform matures, and keep adoption optional until patterns are ready for them. An optional path can still be well-supported and clearly recommended; it should not become a mandatory workflow before it is dependable.
How do you know whether platform engineering is working?
Set measures around the problem the platform is supposed to solve. AWS suggests outcomes such as improvement in the software delivery cycle and fewer operational incidents; it also discusses developer feedback and code-change volume as signals for documentation effectiveness. These are possible local measures, not proof that a portal caused a particular result.
Pair outcome measures with signals about how the platform is used and where the journey still breaks down. For example, review developer feedback alongside adoption of the chosen path and incidents relevant to its supported workflow. Interpret the measures in context: the cited AWS guidance does not establish a universal adoption threshold or benchmark. Use what the team observes to decide whether to improve the path, its documentation or the underlying capability.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
