A company wants a centralized AWS service to enforce organizational compliance and control who can deploy, manage, and decommission AWS resources. Which AWS service is designed to provide that governance?

AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. This enables centralized governance by ensuring users only provision pre-approved resources, enforcing compliance, and maintaining control over deployments. Amazon CloudWatch is a monitoring service, not a governance tool for resource provisioning. Amazon GuardDuty is a threat detection service, focusing on security anomalies. AWS Security Hub provides a comprehensive view of security alerts and compliance status, but it doesn't directly control resource deployment like Service Catalog does.