A county wants to prevent anyone—including account administrators—from disabling Amazon GuardDuty in member accounts. Which control achieves that preventive goal?
Select an answer to reveal the explanation.
Short Explanation
IAM in a member account is like house rules the homeowner can rewrite. An SCP is the city ordinance that still applies even to the mayor of that account—so GuardDuty stays on. Stickers and honor-system IAM do not beat an administrator’s own policy changes.
Full Explanation
Service Control Policies define permission guardrails for AWS Organizations member accounts and constrain even administrators because SCPs sit outside identity policies those admins can edit. Denying GuardDuty disable or delete APIs via SCP is a preventive multi-account control. Account-local IAM policies, informal reminders, or disabling audit trails do not provide equivalent organization-enforced prevention.