AWS Service Catalog
Curated self-service portal of pre-approved infrastructure templates that end users can launch without touching the underlying services.
Verified against AWS documentation · 2026-08-27
Key facts
- 01Admins publish products (CloudFormation or Terraform templates) into portfolios; end users launch them from a catalog view
- 02Launch constraints attach an IAM role to the product — users provision EC2/RDS/etc. without ever holding those permissions themselves
- 03Template constraints restrict what users can input at launch (e.g. instance types capped at t3.medium)
- 04Portfolios can be shared across accounts and AWS Organizations — one governance team, many consumer accounts
- 05Versioned products: push an updated template, users see and can update to the new version
Exam triggers
Phrases and scenarios that point here.
- "Pre-approved", "standardized", "self-service provisioning", "without granting direct access to underlying services"
- Non-technical teams need to launch compliant infrastructure → Service Catalog, not IAM permissions
- Central IT wants to control what gets deployed while devs deploy it themselves
- Enforce governance/compliance on what users can provision → constraints
Not this service
- Buying third-party software/AMIs → AWS Marketplace
- Writing/deploying the templates themselves → CloudFormation
- Full landing zone with guardrails across accounts → Control Tower (which uses Service Catalog under the hood)
Use cases
- 01Data science team self-serves pre-hardened SageMaker notebooks without anyone granting them SageMaker admin rights
- 02New-hire dev environments: one-click launch of a standard VPC + EC2 + RDS stack that security already signed off on
- 03Marketing spins up approved campaign microsites from a template — capped instance sizes, mandatory cost-allocation tags baked in
- 04Enterprise shares one portfolio from a hub account to 50 spoke accounts so every business unit deploys the same vetted stacks
How it's charged
- 01Priced per API call to Service Catalog, not per product, portfolio, or user
- 02First 1,000 API calls per account/region/month are free
- 03AppRegistry basics (create apps, associate resources, manage app tags) are always free
- 04The resources a product provisions (EC2, RDS, etc.) are billed as normal — Service Catalog fees are almost never the cost story
- 05Legacy $5/portfolio/month pricing is obsolete — still floats around old blog posts
