A solutions architect is designing security controls for developer accounts created under AWS Organizations. Developers will have root user–level access to their own accounts, but the architect must ensure the mandatory AWS CloudTrail configuration applied to new developer accounts cannot be modified. Which action meets this requirement?

A Service Control Policy (SCP) is the correct choice because it allows you to centrally manage permissions for all accounts in your AWS Organization. By creating an SCP that explicitly denies actions related to modifying CloudTrail configurations (e.g., cloudtrail:UpdateTrail, cloudtrail:DeleteTrail) and attaching it to the Organizational Unit (OU) containing the developer accounts, you ensure that even the root user in those accounts cannot bypass the policy. IAM policies attached to the root user are ineffective because the root user can always remove or modify their own attached policies. Creating a new trail within developer accounts with the organization trails option enabled doesn't prevent modification of the mandatory trail. Service-linked roles are for specific AWS services to assume permissions and don't provide the organization-wide, preventative control needed here.