A security-auditing application in one AWS account assumes an IAM role to access other accounts in the same AWS Organization. A security audit found that users in the audited member accounts can modify or delete the auditing application’s IAM role. The company needs to prevent anyone except a trusted administrator IAM role from changing that auditing role. Which approach will meet this requirement?

The correct approach is to use an Organization Service Control Policy (SCP) attached to the root. SCPs allow you to centrally manage permissions across all accounts in your AWS Organization. By creating an SCP that explicitly denies modifications to the auditing role for all principals except the trusted administrator role, you enforce this restriction organization-wide. Attaching it to the root ensures it applies to all member accounts. Incorrect options: An SCP that allows the trusted administrator and explicitly denies others, attached to the IAM service in each account, is not a valid SCP application method. SCPs are attached to OUs or the root, not individual services within accounts. IAM permissions boundaries define the maximum permissions an IAM entity can have. They do not prevent users with existing permissions from modifying a role. Attaching a boundary to audited accounts or the auditing role itself would not prevent users from modifying the role if their existing IAM policies allow it.