A company requires that internal teams provision resources only via approved CloudFormation templates, and the security team needs automated detection when resources drift from their expected state. Which strategy satisfies both requirements with appropriate enforcement and automated monitoring?

The correct answer addresses both requirements: controlled provisioning and automated drift detection. AWS Service Catalog allows administrators to create and manage catalogs of approved products (CloudFormation templates in this case). Enforcing a launch constraint for products ensures that users can only provision resources using these approved templates, satisfying the first requirement. AWS Config rules can then be used to continuously monitor resource configurations and detect any deviations from their desired state, fulfilling the drift detection requirement. The other options are less effective. While CloudFormation drift detection can identify changes, it doesn't enforce the initial provisioning to be from approved templates. Using EventBridge for drift detection is less comprehensive and automated than AWS Config rules, which are designed for continuous compliance monitoring.