A 4-year-old media company uses the AWS Organizations all features feature set. The finance team requires that billing information for member accounts must not be accessible to anyone, including the root user of the member accounts. Which solution meets this requirement?

A Service Control Policy (SCP) is the only mechanism within AWS Organizations that can restrict permissions for all IAM users and roles, including the root user of member accounts. By attaching an SCP that denies access to billing information at the root OU level, this policy will apply to all accounts within the organization, ensuring no one, not even the root user, can access that sensitive data. Adding finance users to an IAM group with a Billing policy only grants them access, it doesn't restrict others. An identity-based policy attached to individual users or roles can deny access, but it cannot restrict the root user of a member account. Converting to consolidated billing would not restrict access; it's a billing feature, not a security control for access permissions.