A research team needs full management control of resources in its AWS account, but must be prevented from creating IAM users. The team’s IAM Identity Center permission set grants AdministratorAccess. How can you ensure research team members cannot create IAM users?

The correct answer is to create a Service Control Policy (SCP) that denies iam:CreateUser and attach it to the research team's AWS account. SCPs are a feature of AWS Organizations that allow you to centrally manage permissions across multiple accounts. An explicit deny in an SCP overrides any allow statement, including AdministratorAccess, ensuring that no principal in the affected account can perform the denied action. Attaching an IAM policy to the permission set would not work because an explicit deny in an identity-based policy does not override an explicit allow in another identity-based policy if the principal has both. Using a permissions boundary would restrict the maximum permissions an identity can have, but it doesn't prevent an identity with AdministratorAccess from creating users if that action is allowed by the boundary. A Lambda function would be a reactive solution, allowing the creation of users before deleting them, which doesn't prevent the action as required.