A company using AWS Organizations is migrating workloads to AWS. The application team will deploy Amazon EC2 instances, Amazon S3 buckets, Amazon DynamoDB tables, and Application Load Balancers. The company requires that: • All EC2 instances are launched only from approved AWS accounts. • All DynamoDB tables follow a standardized naming convention. • All infrastructure in any account in the organization must be deployed via AWS CloudFormation templates. Which combination of actions should the application team take? (Choose two.)

The correct options address the requirements for centralized control and enforcement across an organization. Creating CloudFormation templates in a central administrator account and distributing them via StackSets ensures that all infrastructure is deployed consistently and from approved templates, meeting the requirement for all infrastructure to be deployed via CloudFormation and allowing control over EC2 instance launches. Using Service Control Policies (SCPs) is crucial for enforcing organizational-wide restrictions, such as blocking resource provisioning unless specific conditions (like DynamoDB naming conventions) are met, or preventing unapproved EC2 launches. Incorrect options: Creating CloudFormation templates in the application account defeats the purpose of centralized control and consistent deployment. Permissions boundaries are for restricting permissions of IAM principals within an account, not for enforcing organization-wide resource deployment rules or naming conventions. AWS Config managed rules are for auditing compliance after resources are deployed, not for preventing non-compliant deployments in the first place.