Hi Petra, thank you very much, it’s a good question! I think the key is how you define the templates or the code that will ultimately create the resources, and what parameters you want your users to fill in. When you have many users, services, environments, etc., the most important thing is to find the balance between the autonomy and the freedom of the users. For example, if you want to provide a resource that grants permissions to an app, you can do it a few different ways, in terms of user experience:
1. Give me the iam role, actions and resources you want permissions for
2. Give me the name of your application and the arn of the resource
I think the second option gives you the opportunity to control the situation more, so you can avoid problems in the future.
In terms of the reliability of the process, it’s important to maintain the user informed about the errors (slack messages, for example) and set the right alerts to your team to fix anything that might happen