ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

AWS Service Catalog lets central IT create and manage a portfolio of approved products-such as CloudFormation templates for VPCs, EC2 instances, or entire application stacks-with predefined configurations, tagging standards, and permissions. Users can launch these products on demand through a self-service portal, but they cannot modify the underlying templates, ensuring that every resource complies with corporate security and regulatory policies and preventing teams from bypassing governance with unapproved accounts or configurations.

AWS Control Tower simplifies setting up and governing multiple accounts, but it does not by itself give developers a constrained, self-service provisioning experience; they would still need a service such as Service Catalog. AWS CloudFormation alone allows infrastructure as code but does not stop users from creating their own arbitrary templates, so it does not effectively curb shadow IT. AWS IAM Identity Center (formerly AWS SSO) centralizes authentication and authorization but does not provide catalog-based controls over which resources can be deployed. Therefore, AWS Service Catalog is the most appropriate choice for mitigating shadow IT in this scenario.