A project account (not allowed to join the company’s AWS Organization) is launching EC2 instances larger than needed. The company wants to restrict that account so developers can launch only t3.small instances and only in us-east-2. What should a solutions architect do to enforce these requirements within the project's account?

The correct solution is to create an IAM policy because it directly addresses the requirements within the project account. IAM policies define permissions for users, roles, and groups, allowing granular control over AWS resources. By specifying ec2:RunInstances with conditions for ec2:InstanceType as t3.small and ec2:Region as us-east-2, you restrict developers to only launch the permitted instance type in the specified region. This policy can then be attached to the relevant IAM entities used by developers. Creating a new developer account and moving resources is overly complex and unnecessary. Service Control Policies (SCPs) are for AWS Organizations, but the question states the project account is not allowed to join the company's AWS Organization, making SCPs inapplicable. Purchasing Reserved Instances doesn't enforce restrictions on what instances can be launched; it's a cost-saving measure.