Q: How do you design a self-service cloud infrastructure vending pipeline in Backstage that generates least-privilege AWS IAM roles and DynamoDB tables, ensures policy guardrails, and completes provisioning in under 2 minutes without human approvals?

Create a Backstage Software Template collecting service name, environment, and required permissions. Validate input with JSONSchema, forbidding wildcard administrative privileges (*).

# template.yaml (Backstage)
spec:
  parameters:
    - title: Service Info
      properties:
        serviceName: { type: string, pattern: '^[a-z0-9-]+$' }
        databaseType: { type: string, enum: ['dynamodb', 'postgresql'] }
        environment: { type: string, enum: ['dev', 'staging', 'prod'] }

The Scaffolder executes fetch:template and publish:github:pull-request, committing a modular Terraform configuration into the team's dedicated infrastructure directory.

module "service_storage" {
  source       = "git::https://github.com/acme/terraform-modules.git//dynamodb?ref=v2.1.0"
  service_name = "checkout-api"
  environment  = "dev"
  billing_mode = "PAY_PER_REQUEST"
}

A GitHub Actions pipeline runs Open Policy Agent (OPA) / Conftest to verify IAM policies adhere to AWS Permission Boundaries and resource naming conventions. If checks pass, Terraform applies via OIDC without human intervention for dev/stage.