A team will deploy Amazon SageMaker notebook instances but must ensure no notebook instance allows root access. Which method will prevent the deployment of notebook instances that grant root privileges?

IAM condition keys provide fine-grained control over API actions, allowing you to prevent the creation of resources that violate specific policies. By using an IAM policy with a condition key like sagemaker:RootAccess set to false, you can explicitly deny the sagemaker:CreateNotebookInstance action if root access is enabled, thus preventing deployment from the start. AWS KMS keys are used for encryption and decryption, not for controlling resource creation parameters. Monitoring and deleting resources after creation (via EventBridge or CloudFormation and Lambda) is a reactive approach, which doesn't prevent the initial deployment of non-compliant resources. The goal is to prevent deployment, not to clean up afterward.