A university system manages 65 research AWS accounts under Organizations with HIPAA data. Leadership requires central prevention of accounts leaving the organization, blocking S3 buckets from accepting public cross-account access, and requiring encryption on every new EBS volume without touching member-account roles. Which centralized organization policy combination should the governance team deploy to enforce the permission and configuration mandates?

SCPs set maximum permissions for principals, so a deny on organizations:LeaveOrganization keeps member accounts in the organization, and a deny on ec2:CreateVolume when the ec2:Encrypted condition is false blocks unencrypted EBS volumes without touching any member-account role. RCPs set maximum permissions on resources, so a deny on s3:* for principals outside the organization (with an exemption for AWS service principals) blocks external and public access even when a bucket policy would grant it. Using three SCPs fails by concept because SCPs only constrain your own principals and cannot stop a bucket policy from granting access to outsiders, so the S3 mandate goes unmet. IAM permission boundaries fail by concept because they must be attached per role in each account and delegate administration rather than providing root-level preventive control over organization membership or resource policies. Backup Vault Lock with Config rules fails by concept because those are recovery and detective controls that alert after drift instead of preventive organization policies that deny the actions outright. Exam caveat: declarative policies enforce service baselines, but the EC2 declarative attributes cover items such as snapshot block public access and instance metadata defaults, not EBS encryption by default, so use an SCP condition for encryption. Remember SCP equals what principals can do and RCP equals what resources allow. In practice, attach at the root, review the effective policies, and test in a sandbox account before broad rollout.