A regulated enterprise with 120 AWS accounts must block all IAM users from disabling CloudTrail, prevent data exfiltration to external S3 buckets, and centrally restrict AI services from training on content. Only the break-glass admin role may bypass controls. Which organization policy strategy manages these permissions centrally?
Select an answer to reveal the explanation.
Short Explanation
You need guardrails that apply across all 120 accounts, while preserving a narrowly controlled break-glass exception. Organization policies let you centrally set those limits from the root.
Full Explanation
Applying SCPs and AI services opt-out policies at the organization root is the centrally managed strategy for all 120 accounts. SCPs set the maximum permissions available in member accounts, so they can deny CloudTrail changes such as cloudtrail:StopLogging and S3 actions that enable exfiltration to unapproved external buckets. The AI services opt-out policy is a dedicated Organizations policy type that centrally opts content out of training. Configure the controls so only the break-glass admin role is exempt. IAM permissions boundaries are per-role IAM constructs that must be attached individually; they do not scale as a central organization-wide guardrail across every role and account. Service control session policies scope a single assumed-role session and end with that session, so they cannot provide persistent organization-wide enforcement. CloudFormation guardrails and Config rules detect and alert on drift, such as stopped CloudTrail or S3 exposure, but do not prevent the API call at authorization time. For the exam, distinguish preventive organization-level permission controls from detective Config checks. In practice, test the policies in a sandbox OU and verify that ordinary users are blocked while the break-glass role retains only the intended bypass.