A company operates a critical multi-tier application in an AWS VPC. They want to ensure that all network changes, such as modifications to security groups, network ACLs, or route tables, are reviewed and approved before being applied to production environments. They also need a way to easily roll back changes if issues arise. Which AWS service can be used to manage network infrastructure as code, facilitate change review, and enable version control for network configurations?

Why the other options are wrong

• A. AWS Systems Manager Change Manager helps manage operational changes to application configuration and infrastructure, but it's a workflow tool for change control, not for defining infrastructure as code or version control of the configurations themselves.
• B. AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. It's for auditing and compliance, not for defining, versioning, or deploying infrastructure as code.
• D. AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS, but it's for provisioning standardized services, not for managing and versioning arbitrary network infrastructure as code.