I would tell you that this sounds about right, but needs more differentiation.
The question is where your tenant borders lie - so this might happens at any level of infra. Could be cloud subscriptions, could be namespaces in k8s, could be a lot of things for “a tenant”.
If you provide a meaningful interface for self-service, it captures the developer’s intent and not implementation details. Let a developer request “a database” because that is what his service needs to persist data, but hide all configuration details - they can be supplied by your platform when this database is created.
Creating infra and then not deploying anything on it makes no sense either - so the platform should take care of that part of the SDLC and maintain the lifecycle of apps and dependent infra as a whole.