AWS Proton with Terraform: Templates, Self-Managed Provisioning and End-of-Life Migration

AWS Proton was launched at re:Invent 2020 to automate and manage infrastructure provisioning and code deployments for serverless and container-based applications. At launch, AWS CloudFormation was the only option available to customers for provisioning their infrastructure through AWS Proton. Supporting HashiCorp Terraform is currently the most upvoted item on our public roadmap, so it quickly became a post-launch priority.

AWS Proton and Terraform are not direct competitors. They operate at different layers. Terraform is an infrastructure-as-code tool. It provisions and manages cloud resources across any provider using HCL configuration files. AWS Proton is a template management and orchestration layer. It wraps infrastructure-as-code tools in standardized templates with self-service deployment, parameter validation, and version management.

Proton could use Terraform as its provisioning engine. Many teams ran Terraform modules through Proton's template system to get self-service and standardization benefits while keeping Terraform's multi-provider capabilities.

Update March 2026: AWS Proton reaches end of life October 7, 2026. Terraform is not affected — your TF modules and state continue to work. Only the Proton orchestration layer is being discontinued. End of support notice: On October 7, 2026, AWS will end support for AWS Proton. After October 7, 2026, you will no longer be able to access the AWS Proton console or AWS Proton resources. Your deployed infrastructure will remain intact.

What Terraform Does

Terraform is HashiCorp's infrastructure-as-code tool. You write HCL HashiCorp Configuration Language configurations that describe infrastructure resources, and Terraform handles the provisioning lifecycle.

Key capabilities:

• Multi-cloud support AWS, GCP, Azure, Kubernetes, and 3,000+ providers
• State management tracks what's deployed and manages updates
• Plan/apply workflow preview changes before executing
• Module system reusable, parameterized infrastructure components
• Extensive ecosystem Terraform Registry with thousands of community modules
• Terraform Cloud / Enterprise for team collaboration, state management, and policy enforcement

Example resource:

```hcl
resource "awsrdscluster" "database" {
clusteridentifier = "app-${var.environment}"
engine = "aurora-postgresql"
engineversion = "15.4"
masterusername = var.dbusername
masterpassword = var.dbpassword

serverlessv2scalingconfiguration {
mincapacity = 0.5
maxcapacity = 4.0
}
}
```

What AWS Proton Added

Proton didn't replace Terraform. It added an orchestration layer for teams using Terraform or CloudFormation.

Standardized Templates

Platform teams packaged Terraform modules into Proton service templates. Templates are an abstraction layer that empower infrastructure experts within an organization to create reusable infrastructure as code bundles.

AWS Proton is divided into two primary experiences: template management and template deployment. Templates are an abstraction layer that empower infrastructure experts within an organization to create reusable infrastructure as code bundles.

Proton support for Terraform arrived in 2021 with two new features:

• The ability to register AWS Proton templates that are written in HashiCorp Configuration Language HCL, and
• Self-managed provisioning workflows by way of a pull request to a customer-owned git repository.

This is part one of two blog posts regarding this release. In this post, we address the first feature mentioned above, authoring AWS Proton templates using Terraform.

Proton Template Architecture for Terraform

AWS Proton template authoring for Terraform follows the same registration flow as CloudFormation templates.

Prerequisites

If you’d like to work alongside this walkthrough, you will need:

• an AWS account
• an S3 bucket

Walkthrough

For our purposes here, to simplify things, I’ve already gone ahead and created an environment template that you can use over in our samples repository. Start by cloning https://github.com/aws-samples/aws-proton-terraform-sample-templates. There are a couple of templates here; the one we are interested in is located at lambda-vpc/sample-vpc-environment-template/v1.

Peek around and see what it’s creating. We are relying on the Terraform Amazon VPC module to configure a VPC. One thing you should definitely take a look at is infrastructure/outputs.tf. It should look something like the following. If you take a look back at our lambda.tf file that we templatized for AWS Proton, you can see that the outputs here align with the environment outputs referenced there.

Now run the following commands at the root of the repo:

Then upload terraform-vpc-env.tar.gz to any location you want in your S3 bucket.

Now sign in to your AWS Management Console and navigate over to https://console.aws.amazon.com/proton/home#/templates/environments and select the link to Create environment template and fill out the form.

The good news about Terraform templates is that once you’ve completed authoring them, the process to get them registered within AWS Proton is identical to that of CloudFormation based templates.

Template Bundle Structure

In AWS Proton, we can provision resources by 2 methods.

By using Cloudformation as IAC engine

By using Terraform as IAC engine

AWS Managed Provisioning Cloudformation

AWS Managed Provisioning is an option when creating environment/service in Proton. In this approach, Cloudformation creates a stack based on our cloudformation.yaml file. So, AWS Proton will have all the information about deployment status as Proton and Cloudformation work hand in hand.

Self Managed Provisioning Terraform

This is a completely different provisioning method, unlike AWS Managed Provisioning, Proton does not create the resources automatically. But, Proton renders a set of .tf files into a Git repository that we provide to Proton. Then, we can run terraform apply on those files and provision the resources.

First of all, we need to create resources in terraform files and bundle them to create a template bundle. Here’s how a bundle is structured.

Checkout these sample terraform templates in the link below to study how they are structured.

Now, to create a template

Compiled Infrastructure as Code

When you create an environment or service, AWS Proton compiles your infrastructure as code files with console or spec file inputs. It creates proton. and resource-type .variables.tf proton.auto.tfvars.json files for your inputs that can be used by Terraform, as shown in the following examples. These files are located in a specified repository in a folder that matches the environment or service instance name.

The example shows how AWS Proton includes tags in the variable definition and variable values, and how you can propagate these AWS Proton tags to provisioned resources.

Example Terraform configuration used with Proton:

```hcl
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 3.0"
}
}
backend "s3" {
bucket = "terraform-state-bucket"
key = "tf-os-sample/terraform.tfstate"
region = "us-east-1"
}
}

provider "aws" {
region = "us-east-1"
defaulttags {
tags = var.protontags
}
}

resource "awsssmparameter" "myssmparameter" {
name = "myssmparameter"
type = "String"
value = var.environment.inputs.ssmparametervalue
}
```

Self-Managed Provisioning with Terraform

AWS Proton supports self-managed provisioning for Terraform IaC.

For a complete example of a provisioning repository that responds to pull requests and implements infrastructure provisioning, see Terraform OpenSource GitHub Actions automation template for AWS Proton.

How self-managed provisioning works with Terraform IaC template bundle files:

• When you create an environment from Terraform template bundles, AWS Proton compiles your .tf files with console or spec file input parameters.
• It makes a pull request to merge the compiled IaC files to repository that you have registered with AWS Proton.
• If the request is approved, AWS Proton waits on provisioning status that you provide.
• If the request is rejected, the environment creation is cancelled.
• If the pull request times out, environment creation isn't complete.

AWS Proton with Terraform IaC considerations:

• AWS Proton doesn’t manage your Terraform provisioning.
• You must register a provisioning repository with AWS Proton

For more information, see Parameters.

Provisioning Methods Comparison

Terraform Template Bundle Contents

A Terraform template bundle for Proton typically contains:

• Source code .tf files
• Template specification file
• Parameters definition
• Outputs mapping

When you create an environment from Terraform template bundles, AWS Proton compiles your .tf files with console or spec file input parameters. It makes a pull request to merge the compiled IaC files to repository that you have registered with AWS Proton.

If the request is approved, AWS Proton waits on provisioning status that you provide.

End of Life and Migration Considerations

End of support notice: On October 7, 2026, AWS will end support for AWS Proton. After October 7, 2026, you will no longer be able to access the AWS Proton console or AWS Proton resources. Your deployed infrastructure will remain intact. For more information, see AWS Proton Service Deprecation and Migration Guide.

Update March 2026: AWS Proton reaches end of life October 7, 2026. Terraform is not affected — your TF modules and state continue to work. Only the Proton orchestration layer is being discontinued.

For teams that used Proton to wrap Terraform modules for self-service and standardization, migration paths include:

• Continue using Terraform modules directly with CI/CD pipelines
• Move template management to Terraform Cloud / Enterprise with policy enforcement
• Adopt alternative orchestration such as AWS Control Tower, Service Catalog, or custom internal platforms
• Retain existing Terraform state and continue plan/apply workflows without interruption

AWS Proton vs Terraform: They Solve Different Problems

AWS Proton and Terraform are not direct competitors. They operate at different layers.

Terraform is an infrastructure-as-code tool. It provisions and manages cloud resources across any provider AWS, GCP, Azure, etc. using HCL configuration files.

AWS Proton is a template management and orchestration layer. It wraps infrastructure-as-code tools CloudFormation or Terraform in standardized templates with self-service deployment, parameter validation, and version management.

Proton could use Terraform as its provisioning engine. Many teams ran Terraform modules through Proton's template system to get self-service and standardization benefits while keeping Terraform's multi-provider capabilities.

Conclusion

AWS Proton with Terraform provided a specific value proposition for organizations that wanted standardized, self-service infrastructure provisioning without giving up Terraform's multi-cloud flexibility. Proton acted as the control plane for template registration, parameter validation, version management, and pull-request driven self-managed provisioning. Terraform remained the engine that actually rendered and applied infrastructure, with state management and plan/apply workflows under customer control.

The 2021 support for authoring Proton templates in HCL and self-managed provisioning workflows enabled platform teams to package reusable Terraform modules into governed service and environment templates. The compilation step where Proton renders proton.auto.tfvars.json and variables.tf files into a customer-owned repository bridged the gap between Proton's orchestration and Terraform's execution model.

With the announced end of support on October 7, 2026, the Proton orchestration layer will be retired while Terraform continues unchanged. Deployed infrastructure remains intact. Teams will need to migrate template governance and self-service workflows to alternative platforms. The Terraform modules, state files, and HCL configurations authored for Proton remain fully usable outside Proton. The core lesson is that Proton added organizational standardization on top of Terraform rather than replacing it, and that layering can be recreated with other tools as Proton sunsets.

Sources

1. https://www.bunnyshell.com/blog/aws-proton-vs-terraform/
2. https://aws.amazon.com/blogs/containers/aws-proton-terraform-templates/
3. https://awstip.com/proton-with-terraform-and-self-managed-provisioning-fffe1ee94aac
4. https://docs.aws.amazon.com/proton/latest/userguide/ag-infrastructure-tmp-files-terraform.html