A company wants to optimize AWS data-transfer costs and compute costs across developer accounts within the company's organization in AWS…

AWS Service Catalog allows organizations to create and manage a catalog of approved IT services. This solution proactively enforces architectural best practices by providing developers with pre-configured, approved products (a VPC with S3 gateway endpoints and specific EC2 instances). This prevents non-compliant resources from being created. Using S3 gateway endpoints is the most cost-effective method, as it provides a private connection to S3 from a VPC and eliminates data transfer charges through a NAT gateway. The self-service portal model allows developers to deploy resources quickly, meeting the requirement not to negatively affect their speed. Scoping IAM permissions to only allow access to AWS Service Catalog ensures strong governance.

A. Service Control Policies (SCPs) can deny unapproved instance types but cannot enforce the presence of a VPC endpoint. S3 interface endpoints incur hourly and data processing costs, making them less cost-effective than gateway endpoints.
B. This is a reactive, not proactive, solution. It alerts and terminates resources only after costs are incurred, which is disruptive to developers and does not enforce the correct architecture from the start.
D. This is also a reactive approach. AWS Config detects and remediates non-compliance after a resource has already been created, which is inefficient and disruptive to developer workflows, failing the speed requirement. ---

1. AWS Service Catalog Documentation: "AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS... You can control which IT services and versions are available

what is configured in each of the available services

and who can access them by individual

group

department

or cost center."

Source: AWS Service Catalog Developer Guide

"What Is AWS Service Catalog?".

2. AWS VPC Endpoints Documentation (Gateway vs. Interface): "Gateway endpoints provide reliable connectivity to Amazon S3 and DynamoDB without requiring an internet gateway or a NAT device for your VPC... There is no additional charge for using gateway endpoints." This confirms gateway endpoints are the most cost-effective choice over NAT gateways or interface endpoints for this use case.

Source: AWS PrivateLink Guide

"VPC endpoints"

"Gateway endpoints" section.

3. AWS Service Catalog Launch Constraints: "Constraints control the way that users can deploy a product. With launch constraints

you can specify an IAM role that AWS Service Catalog assumes when a user launches a product. This enables you to give a user access to launch a product

without giving them permissions to the underlying services."

Source: AWS Service Catalog Developer Guide

"Constraints".

4. AWS Organizations SCPs Documentation: "SCPs are a type of organization policy that you can use to manage permissions in your organization... SCPs don't affect users or roles in the management account. They affect only the member accounts in your organization." SCPs are for permission guardrails (denying actions)

not for enforcing complex resource configurations.

Source: AWS Organizations User Guide

"Service control policies (SCPs)".