Question

A company manages 120 AWS accounts using AWS Organizations with all features enabled. For data residency and compliance reasons, leadership mandates that no workloads may be created outside the eu-west-1 and eu-central-1 Regions in any member account, including future accounts. The security team must enforce this centrally without relying on developers to configure anything, while still allowing global services (such as IAM, CloudFront, and Route 53) to function normally. What is the MOST effective way to implement this requirement?

Accepted Answer

Attach a Service Control Policy to the organization root that denies all actions when the requested Region is not eu-west-1 or eu-central-1, using a condition on aws:RequestedRegion with a NotAction exception for global services.

Answer

Create an IAM permissions boundary in each account that limits actions to the two approved Regions and attach it to every IAM role and user.

Answer

Enable AWS Config with a managed rule in every account that flags resources created outside the approved Regions and triggers an SSM Automation to delete them.

Answer

Use AWS Control Tower Region deny guardrail applied only to accounts in a single dedicated OU, leaving other OUs unrestricted.