IT Governance with AWS Service Catalog - Standardizing Approved Products and Enabling Self-Service
Learn how to catalog IT-approved CloudFormation templates and safely provide end-user self-service through launch constraints and template constraints.
The Role of Service Catalog
Service Catalog is a service that manages IT-approved AWS resource configurations as a catalog of up to 5,000 products, enabling end users to provision them through self-service. When end users freely create AWS resources, issues arise including security misconfigurations, cost management difficulties, and architectural inconsistency. With Service Catalog, IT teams register CloudFormation templates as products and provide only approved configurations to end users. End users simply select a product from the catalog and enter parameters, and standardized resources are provisioned automatically.
Designing Portfolios and Constraints
A portfolio is a collection of products that grants access to IAM principals (users, groups, roles). You can design portfolios such as a development team portfolio containing dev environment EC2 and RDS, and a data team portfolio containing Redshift and Glue. Launch constraints specify the IAM role used when provisioning a product - resources are created using the role's permissions rather than the end user's own IAM permissions. This allows you to permit resource creation only through the catalog without granting end users direct CloudFormation execution permissions. Template constraints restrict the allowed values of CloudFormation parameters, enabling controls such as limiting instance types to only t3.micro and t3.small.
Usage in Multi-Account Environments
Integration with Organizations lets you share portfolios created in the management account with all accounts or specific OUs in the organization. End users in each account can use products from shared portfolios, applying unified architecture patterns across the entire organization. Product version management enables gradual rollout of template updates. When a new version is published, existing provisioned products are not automatically updated - end users explicitly perform the version upgrade. This prevents unexpected impacts from updates. For planning Service Catalog operational design, related books (Amazon) are a helpful reference.
Service Catalog Pricing
Service Catalog itself incurs no additional charges. Costs consist only of the usage fees for provisioned AWS resources (EC2, RDS, etc.). However, if you use third-party resource types in AWS CloudFormation, charges apply per handler operation. Sharing portfolios via Organizations also incurs no additional fees, making it an attractive low-cost governance foundation for the entire organization. Template constraints that restrict instance types also reduce the risk of end users accidentally creating expensive resources.
Summary
Service Catalog is a service that balances IT governance with end-user self-service. It catalogs approved architecture patterns and enforces safe provisioning through launch constraints and template constraints. Integration with Organizations enables standardization across multi-account environments.