An organization uses AWS Control Tower to manage its AWS Organizations landing zone and has defined an OU structure and core accounts. The DevOps team created a centralized account to host CloudFormation and AWS Service Catalog resources. The company wants to let member accounts request a set of customizations through AWS Control Tower. Which steps, taken together, will provide this capability? (Select three.)

To allow member accounts to request customizations via AWS Control Tower, you need to define the customizations, make them available through Service Catalog, and grant Control Tower the necessary permissions. Authoring a CloudFormation template for each customization (correct) defines the desired resources. Creating an AWS Service Catalog product for each template (correct) makes these customizations discoverable and deployable by end-users in member accounts. Finally, creating an IAM role named AWSControlTowerBlueprintAccess with a trust policy allowing AWSControlTowerAdmin to assume it and attaching AWSServiceCatalogAdminFullAccess (correct) provides AWS Control Tower with the permissions needed to provision Service Catalog products across the organization. Enabling trusted access for CloudFormation with AWS Organizations is not directly related to provisioning Service Catalog products. Creating CloudFormation StackSets with automatic deployment is a method for deploying resources, but it doesn't integrate with the Service Catalog request mechanism described. Deploying CfCT is for advanced customizations and lifecycle events, not for simple Service Catalog product requests.