Developers in multiple AWS accounts in your Organization can create VPCs and launch EC2 instances in a single Region. Each EC2 instance downloads about 1 TB/day from S3, causing high inter-account data-transfer and NAT gateway charges plus compute costs. The company wants to proactively enforce approved architectural patterns (for example, using gateway endpoints) across developer accounts without slowing developer velocity, and do this cost-effectively. Which solution best meets these requirements?

AWS Service Catalog allows you to create and manage a catalog of approved IT services that users can provision. By publishing a portfolio with an approved VPC configuration including S3 gateway endpoints and approved EC2 instances, you enforce architectural patterns while maintaining developer velocity. Developers can quickly provision pre-approved resources without needing to understand the underlying infrastructure details. Restricting IAM permissions to only use Service Catalog ensures compliance. The other options are less effective: SCPs to block unapproved EC2 types and CloudFormation templates for approved VPCs don't proactively enforce S3 gateway endpoints for all VPCs, and restricting to CloudFormation can slow velocity. AWS Budgets is reactive, alerting or terminating after costs accrue, not proactively preventing architectural issues. AWS Config rules are reactive, detecting non-compliance after resources are deployed and then remediating, which can disrupt development.