A company is opening new stores. On each store’s launch day, the company wants to deploy a customized web application for that store. Each store will have separate non-production and production environments, each in its own AWS account. The company uses AWS Organizations and has an OU dedicated to these accounts. Third-party developer teams will perform most of the development work. A security engineer must ensure teams follow the company’s AWS resource deployment plan and must restrict access to the plan to only developers who need it. A CloudFormation template that implements the deployment plan already exists. What should the security engineer do next to meet these requirements most securely?

Creating an AWS Service Catalog portfolio in the organization's management account, adding the CloudFormation template as a product, and sharing the portfolio with the OU is the most secure and scalable solution. Service Catalog allows developers to provision pre-approved AWS resources according to defined templates, ensuring compliance with the company's deployment plan. Sharing with the OU simplifies management across multiple accounts. This approach restricts access to the plan itself while enabling controlled deployment. The CloudFormation CLI options are less suitable because while modules offer reusability, Service Catalog provides a complete solution for governed provisioning, including access control and versioning. The incorrect Service Catalog option that suggests creating an IAM role with AWSServiceCatalogEndUserFullAccess is less secure as it grants broad permissions and doesn't leverage the portfolio sharing mechanism for controlled access to specific products.