ACKF logoACKF
Management and Governance

AWS Service Catalog

View on GitHub

AWS Service Catalog

AWS Service Catalog lets organizations create and manage catalogs of approved IT services for self-service provisioning. Administrators define products (commonly CloudFormation templates and provisioning artifacts), portfolios, and constraints that control how resources are deployed. It sits in the governance and provisioning layer to provide standardized, auditable deployment of AWS resources across accounts.

🗂 Resource Category

Management and Governance • Security, Identity, and Compliance

🧠 Exam Memory Hook

Think: Self-service provisioning + centrally managed products + governance = AWS Service Catalog

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates, secures, and patches the underlying service platform and control plane infrastructure that runs AWS Service Catalog, including the regional service endpoints and management APIs; AWS also maintains service availability and the managed runtime for the control plane.

Customer responsibilities: The customer defines and maintains portfolios, products, provisioning artifacts (for example CloudFormation templates), constraints, TagOptions, IAM roles and policies used to control access, and the content and versions of product templates; the customer is also responsible for monitoring product deployments and for the security, configuration, and lifecycle of the provisioned resources.

Patching responsibilities: AWS patches and maintains the physical infrastructure, hypervisor, operating systems, and the managed service platform that implements the Service Catalog control plane. Patching of guest operating systems, application runtimes, libraries, dependencies, and applications inside provisioned resources is the customer’s responsibility; patching of CloudFormation templates or other product artifacts is the customer’s responsibility as part of product lifecycle management.

🏗 Typical Architecture

💡 Top 5 Features

  • Centralized catalogs of approved products that reference provisioning artifacts such as CloudFormation templates.
  • Portfolio and product management with support for multiple provisioning artifacts (product versions).
  • Launch constraints and role-based access control integrated with AWS Identity and Access Management.
  • Portfolio sharing and delegated administration across accounts through AWS Organizations.
  • Support for TagOptions and constraints to enforce tagging and parameter restrictions at provisioning time.

✅ Top 5 Use Cases

  • Provide a self-service catalog for developers to deploy approved infrastructure using versioned CloudFormation templates while maintaining governance.
  • Distribute standardized, preconfigured product templates across multiple AWS accounts via AWS Organizations to enforce consistency.
  • Apply launch constraints and IAM-based controls to limit which instance types, parameters, or roles can be used when provisioning resources.
  • Manage product lifecycle and roll out new provisioning artifacts (versions) for controlled upgrades of infrastructure patterns.
  • Expose curated, compliant deployment options to internal teams while central IT retains control over templates and permissions.

🏗 Architecture Placement

AWS Service Catalog sits in the governance and provisioning layer of an AWS architecture; users and operators submit provisioning requests to the Service Catalog control plane, which invokes AWS CloudFormation to create the requested resources. It typically enforces controls via IAM and can share portfolios across accounts using AWS Organizations; the Service Catalog control plane is regionally scoped while portfolios can be shared across accounts and organizations.

🎯 Commonly Used With

- AWS CloudFormation
- AWS Organizations
- AWS Identity and Access Management
- AWS CloudTrail
- AWS Config

🌍 5 Real-World Examples

  • A bank publishes hardened, compliant CloudFormation products in a portfolio so development teams can quickly provision pre-approved database and networking stacks while meeting internal controls.
  • A healthcare provider exposes an approved deployment of an EHR test environment as a product to reduce provisioning errors and ensure consistent configurations.
  • A retail company uses Service Catalog to let product teams self-service provisioning of standardized microservice stacks while central IT enforces tagging and launch constraints.
  • A university research group requests standardized compute clusters from a Service Catalog portfolio to ensure researchers use pre-approved instance types and IAM roles.
  • A government agency provides auditors with a catalog of approved logging and monitoring stacks that staff can deploy consistently across accounts.

🎓 AWS Exam Clues

  • Use when you need a centrally managed catalog of approved infrastructure templates with self-service provisioning.
  • Prefer when product definitions are implemented as CloudFormation templates and require versioning and lifecycle control.
  • Consider Service Catalog when you must distribute and control products across multiple accounts via AWS Organizations.
  • Use launch constraints and IAM integration when you need to restrict parameters, roles, or resource types during provisioning.
  • Review auditing and compliance integrations (CloudTrail, AWS Config) because Service Catalog drives CloudFormation deployments that must be monitored.

📝 Quick Revision

AWS Service Catalog provides centrally managed portfolios of approved products (usually CloudFormation templates) for governed self-service provisioning. Use it when you need versioned, auditable, and constrained deployments across accounts, and plan for IAM controls and template maintenance as production considerations.

🏷 Keywords

Portfolio • Product • ProvisioningArtifact • LaunchConstraint • CloudFormationTemplate • TagOptions • PortfolioShare • SelfServiceCatalog • DelegatedAdministrator • ProductVersioning • ServiceCatalogAppRegistry • GovernedProvisioning