AWS Service Catalog for Frontend Teams

Project Overview

Managing Identity and Access Management (IAM) in modern organizations often involves manual, time-consuming processes that lead to delays, security risks, and compliance challenges. Traditionally, IT or Cloud Administrators manually create and assign IAM roles and permissions for development teams, which can result in inconsistent policies and operational bottlenecks.

This project introduces a reusable, easily deployable IAM provisioning solution tailored for Admin self-service using AWS Service Catalog and AWS Cloud Development Kit (CDK). It enables department-level administrators or platform engineers to securely provision pre-approved IAM roles for frontend web development team environment — without having to manually define or modify permissions. The solution can be extended to AWS Service Catalog portfolio for other roles (such as backend, and DevOps teams).

By standardizing IAM roles into catalog products, this solution empowers organizations to accelerate access provisioning, maintain policy consistency, and enforce security best practices. It provides clear separation of responsibilities: central security teams define the guardrails, while delegated admins can deploy trusted configurations to support team needs efficiently and securely.

Roles and Responsibilities

Solution Highlights

This solution delivers the following key components:

• AWS CDK-based IAM role definitions for frontend web development roles
• CloudFormation templates for reusable and secure IAM provisioning
• AWS Service Catalog products for Admins to launch pre-approved IAM roles safely
• Role-permission mapping matrix for clarity and access control transparency
• Self-service IAM provisioning process tailored for Admins and Architects
• Optional constraints and quotas to enforce limits and organizational boundaries
• Step-by-step Deployment Guide for quick setup and onboarding

Downloadable Artifacts

To help you get started quickly, this solution includes downloadable templates and CDK source code:

• GitHub Repository with CDK Code & CloudFormation Templates
• Deployment Guide (as part of the repo README)
• Role-to-Permission Matrix (included in the repository)

These artifacts are designed for reuse and easy deployment across organizations, making IAM provisioning faster, consistent, and secure.

Project Structure:

1. Service Control Policies (SCPs) CDK Template

The file frontend-scp-policies.ts stack defines a set of Service Control Policies (SCPs) that act as guardrails for all AWS accounts under the FrontendDevTeamOU. These SCPs ensure that developers can only access services and configurations that align with cost efficiency, compliance, and security best practices.

The SCPs enforced include:

• Only approved EC2 instance types can be launched (e.g., t3.micro)
• IAM privilege escalation is blocked (e.g., creating roles, attaching policies)
• S3 buckets and objects must remain private (ACL restrictions)
• EBS volumes must be encrypted and limited in size
• ALBs must include ownership and environment tags
• CloudFront distributions must have logging enabled
• Non-frontend services like databases, messaging, and CI/CD tools are denied

These SCPs apply organization-wide and override IAM permissions — they are enforced even for root accounts.

// lib/frontend-scp-policies.ts
import * as cdk from 'aws-cdk-lib';
import * as organizations from 'aws-cdk-lib/aws-organizations';
import { Construct } from 'constructs';

 /**
 * Note: This SCP stack must be deployed from the AWS Organizations 'management/root account'.
 * Requires the AWS Organization Root ID or Parent OU ID passed as a CDK context value.
 * Note:
 * - Use the following command to retrieve root ID: aws organizations list-roots --query 'Roots[0].Id' --output text
 * - Deploy using: cdk deploy --context orgRootId=r-abc123
 * - This enables SCPs and IAM roles to scope to this OU.
 */
 
export class FrontendScpPoliciesStack extends cdk.Stack {
  public readonly frontendOuId: string;
  
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
	
	const parentId = this.node.tryGetContext('orgRootId');
    if (!parentId) {
      throw new Error("Missing required context: orgRootId. Pass it via --context or cdk.json");
    }


	// Define the OU to group frontend development accounts under the specified parent OU
    const frontendOU = new organizations.CfnOrganizationalUnit(this, 'FrontendDevTeamOU', {
      name: 'FrontendDevTeamOU',
      parentId,
    });

    this.frontendOuId = frontendOU.attrId;

    // ========== EC2 INSTANCE TYPE RESTRICTION ==========
    // Prevents launching any EC2 instance outside of cost-efficient, dev-approved types
    new organizations.CfnPolicy(this, 'DenyUnapprovedEc2TypesSCP', {
      name: 'DenyUnapprovedEc2Types',
      description: 'Deny launching non-approved EC2 instance types.',
      type: 'SERVICE_CONTROL_POLICY',
      content: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Deny",
            Action: "ec2:RunInstances",
            Resource: "*",
            Condition: {
              StringNotEqualsIfExists: {
                "ec2:InstanceType": ["t3.micro", "t3.small", "t3.medium"]
              }
            }
          }
        ]
      },
      targetIds: [this.frontendOuId],
    });

    // ========== IAM ADMIN RESTRICTION ==========
    // Prevents IAM escalation by denying critical create/update permissions
    new organizations.CfnPolicy(this, 'DenyIAMAdminSCP', {
      name: 'DenyIAMAdminAccess',
      description: 'Deny IAM admin-level actions.',
      type: 'SERVICE_CONTROL_POLICY',
      content: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Deny",
            Action: [
              "iam:CreateUser",
              "iam:CreateRole",
              "iam:PutRolePolicy",
              "iam:AttachRolePolicy",
              "iam:UpdateAssumeRolePolicy"
            ],
            Resource: "*"
          }
        ]
      },
      targetIds: [this.frontendOuId],
    });

    // ========== S3 PUBLIC ACCESS RESTRICTION ==========
    // Deny attempts to make buckets/objects public using ACLs
    new organizations.CfnPolicy(this, 'DenyS3PublicAccessSCP', {
      name: 'DenyS3PublicAccess',
      description: 'Prevent setting S3 public-read or public-read-write ACLs.',
      type: 'SERVICE_CONTROL_POLICY',
      content: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Deny",
            Action: ["s3:PutBucketAcl", "s3:PutObjectAcl"],
            Resource: "*",
            Condition: {
              StringEqualsIfExists: {
                "s3:x-amz-acl": ["public-read", "public-read-write"]
              }
            }
          }
        ]
      },
      targetIds: [this.frontendOuId],
    });

    // ========== EBS VOLUME RESTRICTION ==========
    // Limit unencrypted and large (>100GiB) volumes from being created
    new organizations.CfnPolicy(this, 'DenyLargeUnencryptedEbsSCP', {
      name: 'DenyLargeUnencryptedEbs',
      description: 'Deny creating EBS volumes larger than 100GiB or without encryption.',
      type: 'SERVICE_CONTROL_POLICY',
      content: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Deny",
            Action: "ec2:CreateVolume",
            Resource: "*",
            Condition: {
              NumericGreaterThanIfExists: { "ec2:VolumeSize": 100 },
              BoolIfExists: { "ec2:Encrypted": "false" }
            }
          }
        ]
      },
      targetIds: [this.frontendOuId],
    });

    // ========== ALB CREATION GUARDRAIL ==========
    // Require traceability tags on all ALBs and target groups
    new organizations.CfnPolicy(this, 'RestrictALBCreationSCP', {
      name: 'RestrictALBCreation',
      description: 'Require ALBs to have tags for ownership and environment.',
      type: 'SERVICE_CONTROL_POLICY',
      content: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Deny",
            Action: [
              "elasticloadbalancing:CreateLoadBalancer",
              "elasticloadbalancing:CreateTargetGroup"
            ],
            Resource: "*",
            Condition: {
              Null: {
                "aws:RequestTag/Owner": "true",
                "aws:RequestTag/Environment": "true"
              }
            }
          }
        ]
      },
      targetIds: [this.frontendOuId],
    });

    // ========== CLOUDFRONT GUARDRAIL ==========
    // Prevent creating distributions without logging enabled (audit readiness)
    new organizations.CfnPolicy(this, 'DenyCloudFrontWithoutLoggingSCP', {
      name: 'DenyCloudFrontWithoutLogging',
      description: 'Deny CloudFront distribution creation if logging is not enabled.',
      type: 'SERVICE_CONTROL_POLICY',
      content: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Deny",
            Action: ["cloudfront:CreateDistribution", "cloudfront:UpdateDistribution"],
            Resource: "*",
            Condition: {
              BoolIfExists: {
                "cloudfront:LoggingEnabled": "false"
              }
            }
          }
        ]
      },
      targetIds: [this.frontendOuId],
    });

    // Note: Non-frontend backend services like databases, queues, or compute options 
    // outside the approved architecture are denied

    new organizations.CfnPolicy(this, 'DenyUnapprovedServicesSCP', {
      name: 'DenyUnapprovedServices',
      description: 'Denies access to backend or irrelevant services for frontend web developers.',
      type: 'SERVICE_CONTROL_POLICY',
      content: {
        Version: "2012-10-17",
        Statement: [
          {
            Sid: 'DenyDatabaseServices',
            Effect: 'Deny',
            Action: [
              "rds:*",
              "dynamodb:*",
              "neptune:*"
            ],
            Resource: "*"
          },
          {
            Sid: 'DenyMessagingServices',
            Effect: 'Deny',
            Action: [
              "sns:*",
              "sqs:*",
              "mq:*"
            ],
            Resource: "*"
          },
          {
            Sid: 'DenyComputeNotInScope',
            Effect: 'Deny',
            Action: [
              "lambda:*",
              "eks:*",
              "ecs:*"
            ],
            Resource: "*"
          },
          {
            Sid: 'DenyDeveloperTooling',
            Effect: 'Deny',
            Action: [
              "cloud9:*",
              "codebuild:*",
              "codedeploy:*",
              "codepipeline:*"
            ],
            Resource: "*"
          }
        ]
      },
      targetIds: [this.frontendOuId],
    });
  }
}

2. IAM Role Definitions CDK Template: Frontend Infrastructure & Service Catalog Access

The file frontend-iam-roles.ts defines the IAM roles necessary for enabling secure, compliant access to AWS resources by both the frontend development team and the Service Catalog engine.

These roles are designed with least-privilege principles, while remaining flexible enough to support CI/CD pipelines, EC2 instances, and developer interactions.

Purpose

• Allow Service Catalog to provision infrastructure through launch roles
• Enable developers to browse and deploy pre-approved Service Catalog products
• Support CI/CD pipelines or dev tools in uploading assets to S3
• Allow EC2 instances to securely read from S3 buckets during runtime

All roles operate within the boundaries defined by attached SCPs and tagging strategies.

IAM Roles Provisioned

// lib/frontend-iam-roles.ts
import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';

/**
 *
 * This stack defines IAM roles scoped for the frontend team to interact with Service Catalog
 * and access S3 buckets from EC2 and CI/CD pipelines.
 *
 */
export class FrontendIamRolesStack extends cdk.Stack {
  public readonly launchRole: iam.Role;
  public readonly devEndUserRole: iam.Role;
  public readonly s3AccessRole: iam.Role;
  public readonly ec2InstanceRole: iam.Role;

  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // ========== SERVICE CATALOG LAUNCH ROLE ==========
    this.launchRole = new iam.Role(this, 'FrontendSCCatalogLaunchRole', {
      assumedBy: new iam.ServicePrincipal('servicecatalog.amazonaws.com'),
      roleName: 'FrontendSCCatalogLaunchRole',
      description: 'Used by Service Catalog to provision frontend infrastructure',
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AdministratorAccess') // adjust later
      ]
    });

    // ========== DEV TEAM END USER ROLE ==========
    this.devEndUserRole = new iam.Role(this, 'FrontendDevSCUserRole', {
      assumedBy: new iam.AccountRootPrincipal(),
      roleName: 'FrontendDevSCUserRole',
      description: 'Allows frontend developers to browse and launch Service Catalog products',
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AWSServiceCatalogEndUserFullAccess')
      ]
    });

    // ========== S3 ACCESS ROLE FOR CI/CD OR DEV TOOLS ==========
    this.s3AccessRole = new iam.Role(this, 'FrontendS3AccessRole', {
      assumedBy: new iam.AccountRootPrincipal(), // Update for federated/OIDC CI/CD if needed
      roleName: 'FrontendS3AccessRole',
      description: 'Allows CI/CD or devs to upload static frontend assets to S3',
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonS3FullAccess')
      ]
    });

    // ========== EC2 INSTANCE ROLE FOR S3 ACCESS ==========
    this.ec2InstanceRole = new iam.Role(this, 'FrontendEc2S3AccessRole', {
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      roleName: 'FrontendEc2S3AccessRole',
      description: 'Allows EC2 instances to access S3 content',
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess')
      ]
    });

    // Optionally attach instance profile if used in ASG/LaunchTemplate
    new iam.CfnInstanceProfile(this, 'FrontendEc2InstanceProfile', {
      roles: [this.ec2InstanceRole.roleName],
      instanceProfileName: 'FrontendEc2InstanceProfile'
    });
  }
}

4. Service Catalog Product Definition CDK Template

The file frontend-dev-product.ts defines a Service Catalog product using AWS CDK, representing a complete frontend infrastructure stack tailored for development environments. The product is encapsulated in a CloudFormationProduct and includes components such as VPC networking, SCP for OU level restricted permissions, S3 for static hosting, CloudFront, EC2-based compute, ACM certificates, and Route 53 DNS.

Additionally, a utility function is provided to associate the product with a Service Catalog portfolio, enabling platform teams to publish it for self-service use by development teams. This approach supports centralized governance while empowering teams with on-demand infrastructure provisioning.

// lib/products/frontend-dev-product.ts
import * as cdk from 'aws-cdk-lib';
import * as servicecatalog from 'aws-cdk-lib/aws-servicecatalog';
import { Construct } from 'constructs';
import { FrontendS3Stack } from '../frontend-s3-stack';
import { FrontendComputeStack } from '../frontend-compute-stack';
import { FrontendAcmRoute53Stack } from '../frontend-acm-route53-stack';
import { FrontendCloudFrontStack } from '../frontend-cloudfront-stack';
import { FrontendSecurityStack } from '../frontend-security-stack';
import { AthenaQueryStack } from '../Athena-query-stack';

/**
 * =========================
 * Service Catalog Product: Frontend Dev Infrastructure
 * =========================
 *
 * This Service Catalog product provisions:
 * - S3 bucket for static site hosting
 * - CloudFront distribution
 * - EC2 ASG with ALB
 * - ACM certificate + Route 53 records
 * - Logging Support for deployed resources
 *
 * Note: These stacks assumes no foundational VPC and security setup present in the account.
 */
export class FrontendDevProduct extends servicecatalog.CloudFormationProduct {
  constructor(scope: Construct, id: string) {
    super(scope, id, {
      productName: 'Frontend Dev Infrastructure',
      owner: 'Platform Admin',
      distributor: 'Self-Service Portal',
      description: 'Provision S3 + CloudFront + Compute + ACM + DNS for frontend this',
      cloudFormationTemplate: servicecatalog.CloudFormationTemplate.fromProductStack(
        new FrontendProductStack(scope, 'FrontendProductStack')
      )
    });
  }
}

/**
 * This stack bundles all required infra for the frontend web product.
 */
class FrontendProductStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    
    const env = {
      account: process.env.CDK_DEFAULT_ACCOUNT, //CDK will get this from ~/.aws/credentials
      region: process.env.CDK_DEFAULT_REGION //CDK will get this from ~/.aws/credentials};
    };

   //  1. Static S3 bucket for frontend assets
    // Retrieve bucket name from context or fallback
    const bucketName = this.node.tryGetContext('bucketName') || 'frontend-default-bucket';
    const s3Stack = new FrontendS3Stack(this, 'FrontendS3Stack', {
      bucketName: bucketName,
      env,
    });

    // 2. ACM + Route53 stack (Certificate and DNS)
    // Retrieve bucket name from context or fallback
    const domainName = this.node.tryGetContext('domainName');
    if (!domainName) {
      throw new Error("Missing required context: domainName. Pass it via --context or cdk.json");
    }
    const acmRoute53Stack = new FrontendAcmRoute53Stack(this, 'FrontendAcmRoute53Stack', {
      domainName: domainName,
      subdomain: 'www',
      distribution: undefined as any, // placeholder to be set after CloudFront stack
      env
    });
    
    // 3. CloudFront stack (uses S3 + ACM)
    const cloudfrontStack = new FrontendCloudFrontStack(this, 'FrontendCloudFrontStack', {
      siteBucket: s3Stack.bucket,
      acmCertificateArn: acmRoute53Stack.certificate.certificateArn,
      domainName: domainName,
      subdomain: 'www',
      loadBalancer: undefined as any, // placeholder to be set after compute stack
      env
    });
    
    // 4. Compute stack (ALB, ASG, EC2, dynamic content, SG based on CloudFront IPs)
    const computeStack = new FrontendComputeStack(this, 'FrontendComputeStack', vpcStack.vpc, {
      env
    });
    
    // Update CloudFrontStack with load balancer (after compute stack is created)
    cloudfrontStack.distribution.node.addDependency(computeStack);
    cloudfrontStack.distribution.node.tryRemoveChild('Resource');
    
    // 5. Reconnect distribution into Route53 stack for alias
    acmRoute53Stack.distribution = cloudfrontStack.distribution;
    
    // 6. Security stack: adds WAF protection to CloudFront with logging
    new FrontendSecurityStack(this, 'FrontendSecurityStack', {
      cloudfrontDistribution: cloudfrontStack.distribution,
      env
    });
    
    // 7. Athena stack to query logs from both CloudFront and S3
    new AthenaQueryStack(this, 'AthenaQueryStack', {
      env,
      logsBucket: cloudfrontStack.logBucket, // assumes shared bucket for simplicity
      cloudfrontPrefix: 'cloudfront-access-logs/',
      s3AccessPrefix: 'frontend-access-logs/',
    });
  }
}


/**
 * This function should be invoked in your Service Catalog stack (e.g., FrontendServiceCatalogStack)
 * to wire this product to the SC portfolio with IAM role access.
 */
export function addFrontendDevProductToPortfolio(scope: Construct, portfolio: servicecatalog.Portfolio) {
   const product = new FrontendDevProduct(scope, 'FrontendDevProduct');
   portfolio.addProduct(product);
 }   

5. Service Catalog Portfolio Configuration (CDK Template)

The file frontend-servicecatalog.ts defines the Service Catalog portfolio for the frontend team using AWS CDK. It creates a portfolio that serves as a container for pre-approved infrastructure products, such as the frontend development stack.

The stack also imports and associates IAM roles to control who can launch the products (launch role) and who can access them (end user role). By linking the FrontendDevProduct to this portfolio, the platform team enables self-service provisioning for frontend developers while maintaining security, consistency, and governance.

// lib/frontend-servicecatalog.ts
import * as cdk from 'aws-cdk-lib';
import * as servicecatalog from 'aws-cdk-lib/aws-servicecatalog';
import { Construct } from 'constructs';
import { addFrontendDevProductToPortfolio } from './products/frontend-dev-product';

/**
 * ==============================
 * Service Catalog Portfolio for Frontend Team
 * ==============================
 *
 * This stack wires IAM roles with a Service Catalog Portfolio.
 * It enables frontend devs to self-service launch pre-approved infrastructure stacks.
 */
export class FrontendServiceCatalogStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps & {
    launchRoleArn: string;
    endUserRoleArn: string;
  }) {
    super(scope, id, props);

    // Create a Service Catalog Portfolio
    const portfolio = new servicecatalog.Portfolio(this, 'FrontendPortfolio', {
      displayName: 'Frontend Dev Infrastructure Portfolio',
      providerName: 'Platform Admin',
      description: 'Contains curated frontend infra stacks (S3, CloudFront, EC2, etc.)'
    });

    // Import IAM roles by ARN
    const launchRole = servicecatalog.Role.fromRoleArn(this, 'LaunchRoleImport', props.launchRoleArn);
    const endUserRole = servicecatalog.Role.fromRoleArn(this, 'EndUserRoleImport', props.endUserRoleArn);

    // Associate roles with portfolio
    portfolio.setLaunchRole(launchRole);
    portfolio.giveAccessToRole(endUserRole);

    // Add Frontend Dev Product to the portfolio
    addFrontendDevProductToPortfolio(this, portfolio);
  }
}

6. Service Quota Limits & Budget Enforcement CDK Template

The file frontend-service-quotas-stack section introduces governance controls to help manage resource usage and cost within the frontend development environment. The FrontendServiceQuotasStack defines strict service limits for critical AWS services such as EC2 and S3, ensuring that resource sprawl is prevented by capping instance counts and bucket creation.

In parallel, the FrontendBudgetsStack sets up a cost budget with automated email notifications when spending exceeds defined thresholds. These controls provide a safety net for platform teams to enforce cost discipline and prevent unexpected overuse of AWS resources, especially in development and sandbox accounts.

 
#// lib/frontend-service-quotas-stack.ts
!/usr/bin/env node
import * as cdk from 'aws-cdk-lib';
import { FrontendServiceCatalogStack } from '../lib/frontend-servicecatalog';
import { VpcNetworkStack } from '../lib/vpc-network-stack';
import { FrontendScpPoliciesStack } from '../lib/frontend-scp-policies';
import { FrontendIamRolesStack } from '../lib/frontend-iam-roles';

const app = new cdk.App();

const env = {
  account: process.env.CDK_DEFAULT_ACCOUNT,
  region: process.env.CDK_DEFAULT_REGION
};


/** Foundational Steps provisioning vps, Devteam OU, Devteam Account, SCP, IAM roles */
// **Caution**: This Stack assume no foundation infrsature is deployed and no VPC/networkin is already present in the account.
// we are creating VPC with CIDR = 10.0.0.0/16, in any case, if you have existing VPC, please update the CIDR accordingly.    
// 1. Create the VPC and networking resources
const vpcStack = new VpcNetworkStack(app, 'VpcNetworkStack', { env });

// 2. Creates OU and SCP to restrict access to the VPC 
new FrontendScpPoliciesStack(app, 'FrontendScpPoliciesStack');

// 3. IAM roles for frontend team to interact with Service Catalog and S3
//  new FrontendIamRolesStack (this, 'FrontendIamRolesStack'); //called in app.ts for arns

// Deploy IAM Roles first
const iamStack = new FrontendIamRolesStack(app, 'FrontendIamRolesStack', { env });

// Pass role ARNs to Service Catalog stack
new FrontendServiceCatalogStack(app, 'FrontendServiceCatalogStack', {
  env,
  launchRoleArn: iamStack.launchRole.roleArn,
  endUserRoleArn: iamStack.devEndUserRole.roleArn
});

7. Application Entry Point CDK Template: Service Catalog Infrastructure Orchestration

The file bin/app.ts section represents the main entry point of the CDK application and coordinates the deployment of all foundational infrastructure components required for a secure, governed, and self-service development environment.

It sequentially provisions a new VPC, sets up Service Control Policies (SCPs), and creates IAM roles used by both Service Catalog and developers. These IAM roles are then passed to the Service Catalog portfolio stack, which registers and configures a curated frontend infrastructure product.

This centralized orchestration ensures all the stacks are instantiated in the correct order with consistent environment setup for frontend teams.

 // bin/app.ts
#!/usr/bin/env node
import * as cdk from 'aws-cdk-lib';
import { FrontendServiceCatalogStack } from '../lib/frontend-servicecatalog';
import { VpcNetworkStack } from '../lib/vpc-network-stack';
import { FrontendScpPoliciesStack } from '../lib/frontend-scp-policies';
import { FrontendIamRolesStack } from '../lib/frontend-iam-roles';
import { FrontendServiceQuotasStack } from '../lib/frontend-service-qouta';
import { FrontendBudgetsStack } from '../lib/frontend-service-qouta';

const app = new cdk.App();

const env = {
  account: process.env.CDK_DEFAULT_ACCOUNT,
  region: process.env.CDK_DEFAULT_REGION
};

/** Foundational Steps provisioning VPC, Devteam OU, Devteam Account, SCP, IAM roles */
// **Caution**: This stack assumes no foundation infrastructure is deployed and 
// no VPC/networking is already present in the account. We are creating VPC with CIDR = 10.0.0.0/16. 
// If you have an existing VPC, please update the CIDR accordingly.    

// 1. Create the VPC and networking resources
const vpcStack = new VpcNetworkStack(app, 'VpcNetworkStack', { env });

// 2. Creates OU and SCP to restrict access to the VPC 
new FrontendScpPoliciesStack(app, 'FrontendScpPoliciesStack');

// 3. IAM roles for frontend team to interact with Service Catalog and S3
const iamStack = new FrontendIamRolesStack(app, 'FrontendIamRolesStack', { env });

// 4. Enforce Service Quotas to prevent overuse of EC2, S3, etc.
new FrontendServiceQuotasStack(app, 'FrontendServiceQuotasStack', { env });

// 5. Set up budget monitoring with user-defined email
const budgetEmail = app.node.tryGetContext('budgetEmail');
if (!budgetEmail) {
  throw new Error('Missing --context budgetEmail=yourname@example.com');
}

new FrontendBudgetsStack(app, 'FrontendBudgetsStack', {
  env,
  budgetEmail: budgetEmail

});

// 6. Pass role ARNs to Service Catalog stack
new FrontendServiceCatalogStack(app, 'FrontendServiceCatalogStack', {
  env,
  launchRoleArn: iamStack.launchRole.roleArn,
  endUserRoleArn: iamStack.devEndUserRole.roleArn
});

8. Deploying to AWS Service Catalog with CDK: Final Step

To publish your complete frontend infrastructure product to AWS Service Catalog, you can use thecdk deploy --all command. This will synthesize and deploy all defined CDK stacks, including networking, SCPs, IAM roles, and the Service Catalog portfolio and product.

Make sure to pass any required context values — such as domain name, bucket name, or budget email — using the--context flag to ensure all stacks receive their necessary runtime configuration.

Deployment Command

cdk deploy --all  
  --context domainName=example.com  
  --context bucketName=frontend-dev-bucket  
  --context budgetEmail=team@example.com
  

This command will register the product into AWS Service Catalog, associate it with the appropriate portfolio and IAM roles, and make it available for self-service launch by approved developers via the AWS Console.