A company uses VPC IP Address Manager (IPAM) with a top-level 10.0.0.0/8 pool and per-account IPAM pools, and shares pools via AWS RAM. The network engineer must prevent users in each AWS account from creating new VPCs unless the CIDR is allocated from that account's IPAM pool, and also prevent associating CIDRs to existing VPCs unless from the account's IPAM pool. Which solution satisfies these requirements?

The correct solution is to create an SCP (Service Control Policy) in AWS Organizations. SCPs are powerful tools for centrally managing permissions across multiple AWS accounts. By denying the CreateVpc and AssociateVpcCidrBlock actions unless the Ipv4IpamPoolId context key is present and matches an allowed IPAM pool ID, you enforce the use of IPAM for all VPC and CIDR block allocations. This prevents users from creating VPCs or associating CIDRs outside of the defined IPAM structure. Incorrect options: AWS Config rules, Lambda functions, and EventBridge rules are reactive. They would detect non-compliant resources after they are created and then attempt to remediate them (e.g., delete the VPC). This is not preventative and can lead to service disruptions or temporary non-compliance. The requirement is to prevent the actions from happening in the first place.