An organization wants to apply the principle of least privilege by ensuring that developers can only deploy infrastructure through approved templates. Which AWS service should they use?