Upload AWS CloudFormation templates that contain approved resources to an Amazon S3 bucket.

Update the IAM policy for the engineers' IAM role to only allow access to Amazon S3 and AWS CloudFormation. Use

AWS CloudFormation templates to provision resources.

Update the IAM policy for the engineers" IAM role with permissions to only allow provisioning of approved

resources and AWS CloudFormation.

Use AWS CloudFormation templates to create stacks with approved resources.

Update the IAM policy for the engineers' IAM role with permissions to only allow AWS CloudFormation actions.

Create a new IAM policy with permission to provision approved resources, and assign the policy to a new IAM service

role.

Using the IAM service role to AWS CloudFormation during stack creation.

Provision resources in AWS CloudFormation stacks.

Update the IAM policy for the engineers' IAM role to only allow access to their own AWS CloudFormation stack.