AWS Certified CloudOps Engineer - Associate
Service Catalog and Control Tower
Letting teams provision for themselves without handing them the keys: Service Catalog portfolios, products, and constraints, shared versus copied catalogs, and the Control Tower landing zone with its OUs, shared accounts, controls, and drift.
Intermediate 30 minutes 6 Learning Objectives
- Explain how a launch constraint lets an end user provision resources they have no permission to create
- Choose the right Service Catalog constraint type for a given governance requirement
- Compare a shared portfolio with a portfolio copied by a StackSet, and state what a recipient administrator can change
- Describe the structure a Control Tower landing zone creates and what lives in each shared account
- Distinguish preventive, detective, and proactive controls by the mechanism each uses
- Recognize the events that put a landing zone into drift and what drift blocks