AWS Service Catalog
Self-service provisioning of approved AWS products: administrators and end users, products from CloudFormation or Terraform, portfolios, versions, launch, template, notification, and tag constraints, launch roles, sharing portfolios across accounts and organizations, TagOptions, and cost.
4 min read · Last reviewed · SAA-C03
Loading your progress
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
AWS Service Catalog lets organizations create and manage catalogs of IT services that are approved for use on AWS. These can be anything from a single EC2 instance or database to a complete multi-tier application. End users can then launch only the approved products they need, within the constraints the organization sets, without needing broad AWS permissions.
Choose Service Catalog when a question asks to let teams self-serve approved infrastructure, enforce standard configurations, or limit which resources users can deploy while still letting them launch things themselves.
Concepts
- Users:
- Catalog administrators prepare the templates, organize products into portfolios, set constraints, and grant access.
- End users browse the products they are allowed to use and launch them.
- Product: an IT service to deploy on AWS, defined by an AWS CloudFormation template or a Terraform configuration (open source or Terraform Cloud). Each product can have several versions.
- Provisioned product: a launched instance of a product, such as a CloudFormation stack.
- Portfolio: a collection of products, with access granted to IAM users, groups, or roles.
- Constraints control how a product in a portfolio can be launched:
- Launch constraint: the IAM role that Service Catalog assumes when an end user launches, updates, or terminates the product. Without it, end users need permissions for CloudFormation and every service the product uses. With a launch role, end users need only the minimum permissions for that product, not direct access to the services it creates.
- Template constraint: limits the parameter values users can choose, such as allowed instance types.
- Notification constraint: sends stack events to an SNS topic.
- Tag update constraint: whether users can change tags after launch.
- Stack set constraint: deploy products across accounts and AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry with StackSets.
- TagOptions: a library of approved tags applied to products and portfolios.
Sharing across accounts
- Share a portfolio account to account, with an organization or OU (Organizational unit)A group of AWS accounts inside an organization in AWS Organizations. OUs can contain other OUs, and policies attached to an OU, such as SCPs, apply to every account in it.Glossary entry in AWS Organizations, or deploy catalogs with StackSets. The receiving account imports the portfolio and grants its own users access.
Security, resilience, performance, and cost
Security
- Least privilegeGiving each person or system only the permissions it needs for its task, and no more. In IAM, this means starting with no access and allowing specific actions on specific resources.Glossary entry: launch constraints let users deploy approved resources without giving them direct permissions to EC2, RDS, and other services.
- Template constraints keep deployments within approved sizes and settings, and TagOptions enforce tagging.
Resilience
- Approved templates can build in best practices, such as Multi-AZRunning standby or extra copies of a resource in other Availability Zones so that it survives the loss of one. An Amazon RDS Multi-AZ deployment keeps one or two standby copies and fails over to one automatically.Glossary entry databases and encryption, so every launch follows them.
Cost
- You pay for API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls to Service Catalog beyond a free tier of 1,000 calls per month, and for the resources the products create. Template constraints help control cost by limiting instance sizes.
Monitoring
- CloudTrail records Service Catalog activity; notification constraints send stack events to SNS.
Service Catalog or another option?
| If the requirement is | Choose |
|---|---|
| Users launch only approved, pre-built products | AWS Service Catalog |
| Engineers define and deploy IaC (Infrastructure as code)Defining infrastructure, such as networks, servers, and permissions, in text files that are versioned and deployed automatically, instead of setting it up by hand. AWS CloudFormation and the AWS CDK are AWS tools for it.Glossary entry | AWS CloudFormation |
| Govern accounts with guardrails | AWS Organizations and Control Tower |
| Provision new accounts from a template | Control Tower Account Factory |
Reverse mindmap: when the question points here
- Yes, when the question says
- Self-service launch of approved resources leads to Service Catalog
- Only approved products and configurations leads to Service Catalog portfolio
- Standard environments for many teams leads to Service Catalog products
- Choose the feature
- Users launch without broad IAM permissions leads to Launch constraint with a role
- Limit instance types users can pick leads to Template constraint
- Share approved products with other accounts leads to Portfolio sharing
- Products defined in Terraform leads to Terraform product type
- Enforce standard tags leads to TagOptions
- No, when the question says
- Write templates and deploy stacks ourselves leads to CloudFormation
- Block services across accounts leads to SCPs
Key takeaways
- Service Catalog provides catalogs of approved products, defined with CloudFormation or Terraform, that end users can launch themselves.
- Products go into portfolios; access is granted to IAM users, groups, and roles.
- Launch constraints let users deploy with a role, so their own permissions can stay minimal; template constraints limit parameter choices.
- Portfolios can be shared across accounts and organizations.
Sources
- AWS Service Catalog Administrator Guide: What is Service Catalog?
- AWS Service Catalog Administrator Guide: Overview of Service Catalog
- AWS Service Catalog Administrator Guide: Managing portfolios
- AWS Service Catalog Administrator Guide: Using AWS Service Catalog constraints
- AWS Service Catalog Administrator Guide: Launch constraints
- AWS Service Catalog Administrator Guide: Sharing and importing portfolios
- AWS Service Catalog Administrator Guide: Sharing a portfolio
- AWS Service Catalog Administrator Guide: TagOption library
- AWS Service Catalog Administrator Guide: Getting started with a Terraform product
- AWS Service Catalog pricing