A company runs production and nonproduction workloads in multiple AWS accounts that are part of an organization in AWS Organizations. The company needs a solution that prevents modification of cost usage tags. Which solution satisfies this requirement?

A Service Control Policy (SCP) is the correct solution because it allows you to centrally manage permissions across all accounts in an AWS Organization. By attaching an SCP to the root or specific OUs, you can explicitly deny actions like ec2:DeleteTags or resource-groups:UntagResources for all principals except those explicitly authorized. This effectively prevents the modification of cost usage tags across the organization. Custom AWS Config rules can detect non-compliance but cannot prevent actions. AWS CloudTrail logs API calls for auditing but does not prevent actions. Custom Amazon CloudWatch logs collect and monitor log data but do not enforce policies or prevent actions.