A large mobile gaming company migrated all on-premises infrastructure to AWS. A solutions architect is auditing the environment against the Well-Architected Framework and reviewing historical costs in Cost Explorer. The architect notices large charges from the creation and termination of large EC2 instance types. Developers are launching EC2 instances for testing and are choosing inappropriate instance types. You must implement a control so developers can only launch approved instance types. Which solution satisfies this requirement?

Creating an IAM policy that explicitly allows or denies specific EC2 instance types during the ec2:RunInstances action is the most effective way to control which instance types developers can launch. By attaching this policy to an IAM group that contains the developers' accounts, you enforce the restriction directly at the permission level. The other options are less suitable: AWS Config rules are for auditing and compliance, not for preventing actions. While a Config rule could detect non-compliant instances, it wouldn't stop their creation. An EC2 launch template can specify instance types, but developers can still choose to launch instances outside of the template if their IAM permissions allow it. EC2 Image Builder creates golden AMIs but doesn't restrict the instance types on which those AMIs can be launched.