A company with hundreds of AWS accounts has centralized procurement for Reserved Instances (RIs). Business units must submit RI purchase or modification requests to a central procurement team; previously business units performed RI purchases/changes directly in their accounts. A solutions architect must enforce this new process securely. Which combination of steps should be taken? (Choose two.)

To enforce centralized RI procurement across hundreds of accounts, the foundational step is to consolidate all AWS accounts under AWS Organizations with all features enabled. This allows for centralized management and policy enforcement. Once consolidated, a Service Control Policy (SCP) is the most effective way to deny specific actions like ec2:PurchaseReservedInstancesOffering and ec2:ModifyReservedInstances across all accounts or OUs. SCPs are applied at the OU or root level and filter permissions for all IAM users and roles within those accounts, ensuring no business unit can bypass the central procurement process. Creating individual IAM policies in each account is impractical and error-prone for hundreds of accounts. Using AWS Config to detect missing policies is reactive, not preventative, and doesn't stop the actions from occurring. Consolidated billing is a feature of Organizations but doesn't directly enforce permission restrictions.