On this page
On this page
- What Is Service Catalog
- Core Concepts
- Products
- Portfolios
- Provisioned Products
- The Permission Model: Launch Constraints
- All Constraint Types
- TagOptions Library
- Portfolio Sharing
- Versioning
- Self-Service vs Governed CloudFormation
- Integration with AWS Config
- Integration with AWS Organizations and Service Catalog AppRegistry
- Key Exam Scenarios
- CloudWatch Integration
- Automatically Published
- Requires Setup
Service Catalog
Service Catalog lets cloud administrators create and manage a curated portfolio of approved AWS products — CloudFormation templates, Terraform configurations, machine learning notebooks — that end users (developers, data scientists, IT teams) can deploy themselves in a self-service manner, within the governance boundaries you define.
The Self-Service Governance Problem
Organizations struggle with a tension: developers need infrastructure quickly to move fast, but IT and security teams need to ensure that infrastructure is compliant, cost-controlled, and properly configured. Without guardrails, developers create ad-hoc resources that violate security policy. With too many guardrails, developers wait weeks for infrastructure requests.
Service Catalog resolves this tension. The cloud team packages approved, compliant infrastructure as a product (say, "Standard VPC" or "Data Science Notebook Environment"). Developers browse the catalog, pick the product they need, fill in a few parameters, and launch it. They get fast self-service; the cloud team gets control over what gets deployed.
Key Concepts
Portfolio — a collection of products grouped together, with permissions defining which users or groups can see and launch them.
Product — a CloudFormation template (or Terraform config, or other artifact) that defines a deployable piece of infrastructure. The cloud team maintains the product; end users only interact with the launch parameters.
Constraints — rules applied to a product that restrict what users can do when launching it. A launch constraint specifies an IAM role to use (so users can launch infrastructure they don't have direct IAM permissions to create). A template constraint restricts which CloudFormation parameters users can modify (e.g., locking the region to us-east-1 or the instance type to t3.micro).
Practical Value
Service Catalog is especially valuable in large organizations where a central cloud platform team serves many internal teams. Instead of writing and maintaining custom approval workflows, the platform team maintains a catalog of well-tested, compliant products and lets teams self-serve within that approved set.