Question

A company uses AWS Organizations to manage 40 member accounts across several development teams. For compliance reasons, all workloads must run only in the eu-west-1 and eu-central-1 Regions. Developers have wide-ranging IAM permissions within their own accounts, and the security team wants to guarantee that no one — including account administrators — can create or use resources in any other Region. Which approach enforces this requirement most effectively?

Accepted Answer

Attach a service control policy (SCP) to the organizational units that denies all actions when the requested Region is not eu-west-1 or eu-central-1.

Answer

Add a Region condition to each developer's IAM identity policy in every member account to deny actions outside the approved Regions.

Answer

Create an IAM permissions boundary in each account that limits users to the two approved Regions.

Answer

Enable AWS Config with a managed rule that flags resources created outside the approved Regions and sends an alert to the security team.