A developer in a shared development AWS account needs to create service-linked roles for services used in a proof of concept. The account is part of an AWS Organization. The developer must be able to create and configure service-linked roles, and nothing more. Which approach meets this requirement?

The correct approach is to create an IAM role with precise permissions to create policies and roles, then attach a permissions boundary to that role. This ensures the developer can perform only the required actions (creating service-linked roles) and nothing more, as the permissions boundary sets the maximum allowed permissions. The developer assumes this role. Incorrect options: Creating an IAM user in the Organizations management account and a cross-account role in the development account is overly complex and doesn't inherently restrict the developer to only service-linked role creation. Attaching PowerUserAccess grants broad permissions, far exceeding the requirement to only create and configure service-linked roles. MFA enhances security but doesn't restrict permissions. An SCP denying iam: actions would prevent the developer from creating any IAM resources, including service-linked roles, which contradicts the requirement.