Spin up fully-provisioned ISV environments (Databricks, Snowflake, Confluent) in minutes. Auto-cleanup when you're done. Zero manual teardown.
A self-service platform that provisions, manages, and automatically tears down ISV environments on AWS
Pre-built, hardened modules per ISV. Parameterized for owner, TTL, cost center, and environment size.
SCPs, budget alerts, permission boundaries, and mandatory tagging ensure cost control and blast radius limits.
TTL-based expiry with EventBridge + Lambda. Get reminded before destruction. Extend with one click.
Per-environment cost tracking via tags. Daily cost reports. Budget thresholds with auto-notification.
From request to cleanup — fully automated, zero manual intervention
Open MR with params (ISV, size, TTL)
CI/CD runs terraform apply
Environment ready, credentials in Secrets Manager
Slack/email notification before expiry
terraform destroy on TTL expiry
| Layer | Tool | Purpose |
|---|---|---|
| IaC Engine | Terraform | Provision AWS infra + ISV resources via dual providers |
| CI/CD | GitLab CI | Pipeline: plan, apply, tag, schedule destroy |
| State | S3 + DynamoDB | Terraform remote state with locking |
| Secrets | Secrets Manager | ISV credentials and API tokens |
| Scheduling | EventBridge | TTL expiry triggers and reminder notifications |
| Notifications | SNS + Slack | Expiry reminders, cost alerts, provision confirmations |
| Cost | AWS Budgets | Per-environment budget caps with auto-alerts |
Supported ISV environments — deploy any of these with a single merge request
Deploy your first ISV sandbox in 3 steps
# 1. Clone the repository git clone git@gitlab.aws.dev:rohitvas/isv-sandbox-vending-machine.git cd isv-sandbox-vending-machine # 2. Create your environment config cp environments/template.tfvars environments/my-demo.tfvars # 3. Edit your config isv_type = "databricks" owner_email = "yourname@amazon.com" ttl_hours = 72 environment = "demo" cost_center = "your-cost-center" # 4. Push and create MR git checkout -b deploy/my-demo git add . && git commit -m "Deploy Databricks sandbox" git push origin deploy/my-demo
Clone the repo, copy the template tfvars, and fill in your ISV choice, TTL, and ownership details.
Push your branch and open an MR. The pipeline runs terraform plan and shows what will be created.
Approve the MR, CI runs terraform apply, credentials appear in Secrets Manager. Done.
Clean, modular Terraform with clear separation of concerns
isv-sandbox-vending-machine/ +-- modules/ | +-- databricks/ | | +-- main.tf # Workspace, clusters, Unity Catalog | | +-- networking.tf # VPC, subnets, security groups | | +-- iam.tf # Cross-account IAM roles | | +-- storage.tf # S3 buckets for DBFS root | | +-- variables.tf | | +-- outputs.tf | +-- cleanup/ | | +-- main.tf # EventBridge rule + Lambda | | +-- lambda/destroy.py # Triggers terraform destroy | | +-- variables.tf | +-- notifications/ | +-- main.tf # SNS + Slack webhook | +-- variables.tf +-- environments/ | +-- template.tfvars # Copy this for new envs | +-- examples/ +-- .gitlab-ci.yml # CI/CD pipeline definition +-- main.tf # Root module composition +-- providers.tf # AWS + Databricks providers +-- backend.tf # S3 remote state config +-- variables.tf # Input variables +-- README.md