Which AWS Service Governs Who Can Deploy and Manage Resources?
A company wants to use a centralized AWS service to enforce compliance with the organizational business standards. The company wants to use an AWS service that can govern and control who can deploy, manage, and decommission AWS resources. Which AWS service will meet these requirements?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the difference between governance/control of provisioning (Service Catalog) and monitoring, threat detection, or posture aggregation (CloudWatch, GuardDuty, Security Hub), with the trap being to pick a security service because the word "compliance" appears.
AWS Service Catalog is the centralized AWS service that lets an organization publish an approved portfolio of IT services and control which users can deploy, manage, and decommission resources. This page confirms why Service Catalog — not CloudWatch, GuardDuty, or Security Hub — satisfies the governance and compliance requirement in this CLF-C02 question.
Candidates often choose AWS Security Hub or Amazon GuardDuty because the stem says "enforce compliance" — but those services detect and aggregate findings, they do not govern or control who may deploy, manage, and decommission AWS resources.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Service Catalog is purpose-built for centralized governance of provisioning: administrators create portfolios of approved products (AMIs, servers, software, databases) with constraints and IAM-based launch roles, so end users can only deploy resources that already match organizational business standards. Because every product is defined and version-controlled by the catalog owner, Service Catalog directly answers the "who can deploy, manage, and decommission AWS resources" requirement. Constraints and tag options also prevent users from deviating from approved configurations, which is exactly the compliance enforcement described in the stem. That is why the source key's option B is the right call and the community vote is unanimous here.Why the Other Options Are Wrong
Amazon CloudWatch is an observability service for metrics, logs, alarms, and dashboards; it reports on resources but cannot restrict who deploys them. Amazon GuardDuty is a managed threat-detection service that analyzes CloudTrail, VPC Flow Logs, and DNS logs for malicious or anomalous activity — detection, not provisioning governance. AWS Security Hub aggregates and prioritizes security findings and runs automated compliance checks against standards such as CIS and PCI DSS, but it identifies drift rather than controlling which resources users are allowed to create. None of these three can gate the deployment of resources, so none meets the "govern and control" wording.Community Comment Notes
As Marley explains, Service Catalog "allows organizations to create and manage catalogs of IT services that are approved for use on AWS," and reaches the same conclusion that only compliant and approved resources can be deployed. Another learner (7979ff7) simply states "B. AWS Service Catalog is correct answer" and points to the AWS Service Catalog Administrator Guide introduction page, which is the authoritative description of portfolios, products, and constraints. d00b229 also concurs with option B. No commenter defends CloudWatch, GuardDuty, or Security Hub, so there is no dissenting reasoning to weigh against the official documentation.Official Reference
Exam Strategy
When a CLF-C02 stem emphasizes controlling, governing, or standardizing what teams may provision, scan the options for a governance/provisioning service (Service Catalog, Organizations, Control Tower) before any monitoring or detection service. Keywords like "approved," "pre-approved," and "catalog" are strong signals for Service Catalog.
Frequently Asked Questions
Why is AWS Security Hub wrong for governing who can deploy resources?
Security Hub aggregates and prioritizes security findings and runs compliance checks, but it only reports on posture. It cannot restrict or approve which users deploy, manage, or decommission AWS resources.
How does AWS Service Catalog enforce organizational standards?
Admins publish approved products into portfolios and attach constraints and IAM launch roles. End users can then deploy only those pre-approved, standardized resources in their accounts.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →