A company uses AWS Organizations to manage multiple AWS accounts for human resources, finance, software development, and production. All developers are in the software development account. Some developers have launched Amazon EC2 instances with unapproved software. The company must ensure developers can launch EC2 instances only with approved applications and only in the software development account. Which solution meets these requirements?

AWS Service Catalog is designed for exactly this use case: allowing users to provision pre-approved AWS resources. By creating a Service Catalog portfolio with EC2 products that use AMIs containing only approved software, and then granting developers access only to this portfolio within the software development account, the company ensures that developers can only launch instances with sanctioned software in the correct account. The other options are less effective or introduce unnecessary complexity. CloudFormation templates (first option) don't prevent developers from launching instances outside the template. EventBridge and Systems Manager (second option) are reactive, installing software after an instance is launched, which doesn't prevent unapproved software from being initially deployed. CloudFormation StackSets from the management account (fourth option) are for deploying resources across accounts, not for restricting user launches within a specific account, and granting developers access to the management account is a security risk.