A company needs to securely deploy resources and workloads across multiple AWS accounts within an AWS Organizations organization. The company will manage infrastructure as code (IaC) with AWS CloudFormation using only approved architectural patterns. The company must also enforce mandatory tagging and specific configuration standards for resource creation. Which solution meets these requirements?

This solution effectively addresses all requirements. AWS Service Catalog allows the company to curate and share approved CloudFormation templates (products) as portfolios across the organization, ensuring only approved architectural patterns are used. This inherently controls access to these configurations. AWS Config rules can then be deployed to enforce mandatory tagging and specific configuration standards for resources created from these templates or otherwise. Incorrect options: CloudFormation stack policies control updates to stack resources, not initial creation based on tagging or configuration. EventBridge can detect API calls but doesn't prevent resource creation or enforce standards. While CodePipeline aids deployment and Config rules enforce tagging, SCPs cannot prevent "misconfigured" resources in the nuanced way required; they primarily restrict AWS service actions. IAM permissions boundaries restrict the maximum permissions an identity can have but don't directly enforce tagging or specific configuration standards for resource creation within CloudFormation beyond what the template allows.