A company uses AWS Organizations and plans to add about 1,000 more accounts. Currently, only the central security team can create IAM roles. To reduce bottlenecks, application teams need to provision their own IAM roles, but the roles must be constrained in scope and must not allow privilege escalation. What is the solution with the least operational overhead?

The correct solution leverages an SCP and an IAM permissions boundary to delegate IAM role creation securely and with minimal overhead. The SCP, attached to the root OU, ensures that only roles with a specific permissions boundary can create new IAM roles. This boundary, in turn, defines the maximum permissions a new role can have, preventing privilege escalation. This central control mechanism allows application teams to self-service while adhering to security constraints. Incorrect options: Creating IAM groups and users for each team doesn't address the core problem of delegating role creation securely and at scale. Delegating to team leads and conducting reviews is a manual, high-overhead process that doesn't scale well to 1,000 accounts and introduces potential for human error. Placing each account in its own OU with SCPs for service allowance is good practice for resource governance but doesn't directly solve the challenge of delegating IAM role creation with specific constraints.