Which AWS Service Governs Who Can Deploy and Manage Resources?
Short answer
B AWS Service Catalog governs and controls which approved AWS resources users can deploy, manage, and decommission.
Question
Key Takeaways
The question tests the difference between governance/control of provisioning (Service Catalog) and monitoring, threat detection, or posture aggregation (CloudWatch, GuardDuty, Security Hub), with the trap being to pick a security service because the word "compliance" appears.
AWS Service Catalog is the centralized AWS service that lets an organization publish an approved portfolio of IT services and control which users can deploy, manage, and decommission resources. This page confirms why Service Catalog — not CloudWatch, GuardDuty, or Security Hub — satisfies the governance and compliance requirement in this CLF-C02 question.
Common mistake: Candidates often choose AWS Security Hub or Amazon GuardDuty because the stem says "enforce compliance" — but those services detect and aggregate findings, they do not govern or control who may deploy, manage, and decommission AWS resources.
Expert Analysis
Why the Answer Is Correct
AWS Service Catalog is purpose-built for centralized governance of provisioning: administrators create portfolios of approved products (AMIs, servers, software, databases) with constraints and IAM-based launch roles, so end users can only deploy resources that already match organizational business standards. Because every product is defined and version-controlled by the catalog owner, Service Catalog directly answers the "who can deploy, manage, and decommission AWS resources" requirement. Constraints and tag options also prevent users from deviating from approved configurations, which is exactly the compliance enforcement described in the stem. That is why the source key's option B is the right call and the community vote is unanimous here.
Why the Other Options Are Wrong
Amazon CloudWatch is an observability service for metrics, logs, alarms, and dashboards; it reports on resources but cannot restrict who deploys them. Amazon GuardDuty is a managed threat-detection service that analyzes CloudTrail, VPC Flow Logs, and DNS logs for malicious or anomalous activity — detection, not provisioning governance. AWS Security Hub aggregates and prioritizes security findings and runs automated compliance checks against standards such as CIS and PCI DSS, but it identifies drift rather than controlling which resources users are allowed to create. None of these three can gate the deployment of resources, so none meets the "govern and control" wording.
Community Comment Notes
As Marley explains, Service Catalog "allows organizations to create and manage catalogs of IT services that are approved for use on AWS," and reaches the same conclusion that only compliant and approved resources can be deployed. Another learner (7979ff7) simply states "B. AWS Service Catalog is correct answer" and points to the AWS Service Catalog Administrator Guide introduction page, which is the authoritative description of portfolios, products, and constraints. d00b229 also concurs with option B. No commenter defends CloudWatch, GuardDuty, or Security Hub, so there is no dissenting reasoning to weigh against the official documentation.
Official Reference
https://docs.aws.amazon.com/servicecatalog/latest/adminguide/introduction.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a CLF-C02 stem emphasizes controlling, governing, or standardizing what teams may provision, scan the options for a governance/provisioning service (Service Catalog, Organizations, Control Tower) before any monitoring or detection service. Keywords like "approved," "pre-approved," and "catalog" are strong signals for Service Catalog.
Frequently Asked Questions
Why is AWS Security Hub wrong for governing who can deploy resources?
How does AWS Service Catalog enforce organizational standards?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Marley 👍 2AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. It helps enforce compliance by controlling which services and configurations are available for deployment. Administrators can define and manage these catalogs, ensuring that only compliant and approved resources can be deployed. This service also helps in governing and controlling the lifecycle of these resources, from deployment to decommissioning.
-
7979ff7 👍 1 Answered BB. AWS Service Catalog is correct answer. https://docs.aws.amazon.com/servicecatalog/latest/adminguide/introduction.html
-
d00b229 👍 1B. AWS Service Catalog.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →