What should a SysOps administrator do to implement this requirement?

Explanations:

An EC2 instance launch configuration is not a valid resource in AWS. Instead, EC2 instances are launched using AMIs, instance types, and other parameters. Launch configurations are used for Auto Scaling groups, not individual EC2 instance provisioning.

IAM policies cannot enforce specific EC2 instance configurations directly. While IAM policies can restrict what actions users can take, they don’t specify approved instance configurations. Using AWS CloudFormation templates would require more than just IAM policies and would need to be implemented differently.

AWS Service Catalog allows for the creation of approved products (such as specific EC2 configurations). By creating a Service Catalog product and launch constraint, the SysOps administrator can enforce the use of predefined EC2 configurations. This limits business units to only launch approved configurations.

Sharing an AWS CloudFormation template is not sufficient by itself to enforce approved EC2 configurations. The business units would still have the flexibility to modify the CloudFormation template, which doesn’t guarantee that only approved configurations are used. Additionally, passing a role to CloudFormation is not a restriction method for enforcing configurations.