A company policy permits engineers to provision only approved resources and mandates using AWS CloudFormation to create those resources. You must enforce this restriction for the IAM role that engineers assume. What should you do to implement enforcement?

This approach enforces the policy by separating permissions. The engineers' IAM role is restricted to CloudFormation actions only, preventing them from directly provisioning any resources. A separate IAM service role, with permissions to create only approved resources, is then attached to the CloudFormation stack. When CloudFormation executes, it assumes this service role, ensuring that only permitted resources are provisioned. This method aligns with the principle of least privilege and provides a robust control mechanism. The other options are less secure or less effective. Uploading templates to S3 and restricting access still allows engineers to directly interact with S3, and doesn't inherently prevent them from provisioning unapproved resources if their CloudFormation permissions are broad. Updating the engineers' IAM role to allow specific resource types directly bypasses the CloudFormation enforcement for provisioning. Restricting access to only owned CloudFormation stacks doesn't prevent them from creating new, unapproved stacks.