After acquiring another company and adding it as a new OU in AWS Organizations, a DevOps engineer must ensure the new OU can only launch t3.small EC2 instances and may launch instances only in US Regions. Which SCP configuration enforces these constraints?

The correct option uses a deny-by-default approach, which is a best practice for security. By denying ec2:RunInstances when the instance type is not t3.small, it effectively restricts launches to only t3.small. Similarly, denying ec2:RunInstances when the requested region is not a US region (using us- for pattern matching) ensures instances are only launched in US regions. SCPs are implicitly deny, so explicit Deny statements are powerful. The incorrect options either use incorrect logic (e.g., allowing when not equal, denying when equal to the desired value) or attempt to use Allow statements in a way that would not enforce the constraints effectively. SCPs do not have an explicit "allow only" mechanism; instead, they rely on denying everything else.