A county wants developers to deploy into a sandbox account but must prevent creation of IAM users that attach AdministratorAccess. Which multi-account control best enforces that guardrail?
Select an answer to reveal the explanation.
Short Explanation
A polite reminder in Slack is not a lock on the sandbox door. SCPs and permission boundaries sit above what developers can grant themselves, so AdministratorAccess IAM users never get born. Logging off or handing out management-account root makes the problem worse.
Full Explanation
In a multi-account strategy, Service Control Policies limit the maximum permissions available in member accounts, and IAM permission boundaries restrict what an identity can delegate. Together they prevent sandbox developers from creating IAM users with unrestricted AdministratorAccess even if they can manage some IAM resources. Verbal policy, disabling audit logging, or sharing management-account root credentials do not provide enforceable least-privilege guardrails.