The QA manager currently launches application test environments using a CloudFormation template in an AWS account by assuming a role with CloudFormation, EC2, and Auto Scaling permissions. The QA department wants testers to be able to launch their own short‑lived environments, but testers should not receive broad permissions. Which setup will meet these goals?

AWS Service Catalog allows administrators to create and manage catalogs of approved IT services for use on AWS. By creating a Service Catalog product from the CloudFormation template, the QA manager can define a standardized, pre-approved environment. The launch constraint ensures that the product is launched using the existing, appropriately permissioned role, preventing testers from needing broad permissions themselves. Testers only need permissions to use Service Catalog APIs, providing a highly controlled and secure way to provision resources. The other options are less secure or efficient: Granting users permission to assume the manager's role, even with a restrictive policy, still involves more direct access to a powerful role than necessary. Giving users direct CloudFormation and S3 permissions, even with conditions, is more complex to manage and potentially less secure than Service Catalog. Elastic Beanstalk is for deploying web applications and services, not for general-purpose environment provisioning via CloudFormation templates, and would require more setup and management overhead for this use case.