A healthcare company has multiple AWS accounts in an AWS Organizations organization. The company stores sensitive patient data in Amazon S3 and must prevent users from deleting any S3 bucket across all accounts. What is the most scalable way to enforce this control?

Service control policies (SCPs) are the most scalable way to enforce this control across multiple AWS accounts in an AWS Organizations organization. SCPs allow you to centrally manage permissions for all accounts in your organization, restricting actions like s3:DeleteBucket. This ensures a consistent security posture without needing to configure individual IAM policies in each account. IAM permissions boundaries define the maximum permissions an IAM entity can have, but they still require individual IAM policies to grant permissions, making them less scalable for organization-wide enforcement. S3 bucket policies are specific to individual S3 buckets and would need to be applied to every bucket, which is not scalable for preventing deletion across all buckets in all accounts. Tag policies help enforce tagging conventions but do not control resource actions like deletion.