A company must prevent Amazon S3 objects from being shared with IAM principals that are outside its AWS Organizations organization. The company is creating a service control policy (SCP) to enforce this requirement and has already enabled S3 Block Public Access on all buckets. What should the SCP do to meet the requirement?

The correct SCP denies all S3 actions (S3:) when the resource's organization ID (aws:ResourceOrgID) does not match the principal's organization ID (aws:PrincipalOrgID). This effectively prevents S3 objects owned by accounts within the organization from being shared with principals outside the organization. The aws:ResourceOrgID condition key refers to the organization ID of the account that owns the S3 resource, and aws:PrincipalOrgID refers to the organization ID of the principal making the request. The other options are incorrect because: Denying S3:PutAccountPublicAccessBlock only prevents changes to S3 Block Public Access settings, not sharing of objects. An Allow statement with StringNotEquals would allow access to external principals, which is the opposite of the requirement. Denying S3: based on aws:PrincipalArn for external principals is less scalable and harder to maintain than using organization IDs, as it requires explicitly listing ARNs.