// the find
awslabs/harmonix
A developer portal to meet your Enterprise needs. Fast, secure, and at-scale.
Harmonix was an AWS-flavored Backstage distribution that wrapped ECS, EKS, and serverless deployment patterns behind a developer portal UI. It's deprecated as of December 2025 with a critical security vulnerability notice in the README — not something you want to adopt today.
- The plugin architecture is well-decomposed: common types, backend API layer, and frontend components are separate packages, so there's something to study in how they extended Backstage's entity model with custom AWS environment types.
- Custom Backstage entity kinds (AWSEnvironmentEntityV1, AWSEnvironmentProviderEntityV1) with JSON Schema definitions is the right way to extend Backstage — worth reading if you're building your own Backstage plugins.
- Covers a real gap: wiring Backstage to multi-account AWS setups (ECS, EKS, serverless, CloudFormation) with environment promotion flows is genuinely hard, and the scaffolder templates here were practical starting points.
- Deprecated and abandoned. The README leads with a security warning and an end-of-life notice. Adopting this in a new project is starting a maintenance burden on day one with no upstream to pull fixes from.
- The security vulnerabilities are unspecified — 'please upgrade to v0.4.2' with no CVE numbers or details means you can't assess the blast radius before deciding whether to fork and patch.
- Heavy AWS lock-in by design: the entire mental model is AWS accounts, IAM roles, and AWS-specific resource types. The abstraction doesn't generalize; if your cloud strategy changes, the portal needs a rewrite.
- Backstage itself moves fast and breaks plugin APIs regularly. A deprecated project at an unknown Backstage version will rot quickly — the patch files in backstage-mods/ suggest they were already fighting upstream drift.