Per the AWS Cloud Operations and Service Catalog documentation, when a portfolio is shared across AWS accounts, the recipient account imports the shared portfolio.
The recipient CloudOps engineer cannot modify the original products or their configurations but can:
Add products from the imported portfolio into their local portfolios for deployment,
Control end-user access in the recipient account, and
Manage local constraints or permissions.
However, the recipient cannot edit, delete, or reconfigure the shared products (Options B, C, and D). The source (owner) account retains full administrative control over products, launch roles, and lifecycle policies.
This model aligns with AWS CloudOps principles of centralized governance with distributed self-service deployment across multiple accounts.
Thus, Option A is correct—imported portfolios allow the recipient to add products to a local portfolio but not alter the shared configuration.
[Reference: AWS Cloud Operations & Governance Guide – Managing Shared AWS Service Catalog Portfolios Across Multiple Accounts, ]
