A large enterprise is adopting a multi-account strategy with a centralized security team responsible for defining and enforcing approved infrastructure patterns. Development teams need to provision common services (e.g., standard EC2 instances, S3 buckets with specific tagging and encryption policies, standardized databases) in their respective accounts without deviating from these approved patterns. The solution must allow developers to self-service these resources while ensuring compliance. Which AWS service is best suited to meet these requirements?
- AAWS Organizations Service Control Policies (SCPs)
- BAWS CloudFormation StackSets
- CAWS Config with auto-remediation
- DAWS Service Catalog
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Service Catalog
AWS Service Catalog allows organizations to create and manage catalogs of approved IT services that are compliant with company standards. It enables development teams to self-service these pre-approved resources, ensuring they are provisioned according to the centralized security team's patterns and policies without requiring direct CloudFormation template access or modification.
Why the other options are wrong
- A. SCPs prevent actions but don't offer a mechanism for self-service compliant provisioning; they are guardrails.
- B. StackSets deploy identical stacks across accounts, but don't provide a self-service portal for developers to choose and provision specific products.
- C. AWS Config detects non-compliance after provisioning; it doesn't prevent non-compliant provisioning in the first place or offer self-service.
AWS Service Catalog
AWS Service Catalog allows organizations to create, govern, and manage a catalog of IT services that are approved for use on AWS. These services can include everything from virtual machine images, servers, software, databases, to complete multi-tier application architectures. It enables end-users to self-service these products while adhering to organizational standards.
- Centralized catalog of approved IT services (products).
- Enables self-service provisioning for end-users.
- Ensures governance and compliance with organizational standards.
- Uses CloudFormation templates as the underlying product definition.
Memory trick: Service Catalog is your compliant AWS shopping cart for developers.