An AWS Organization (all features enabled) manages multiple accounts that run EC2 instances. The company requires that all current EC2 instances use Instance Metadata Service v2 (IMDSv2). They want to block any AWS API calls originating from EC2 instances that do not use IMDSv2. Which approach satisfies this requirement?

The correct answer is to create an SCP that denies actions when the ec2:MetadataHttpTokens condition key value is not equal to required. Attaching this SCP to the organization root ensures that all new EC2 instances launched across the organization enforce IMDSv2. The ec2:MetadataHttpTokens condition key directly controls whether IMDSv2 (value required) or IMDSv1 (value optional) is used. By denying actions when it's not required, you prevent the creation of instances configured for IMDSv1. The other options are incorrect because: Denying ec2:RunInstances when ec2:MetadataHttpTokens is not equal to required only prevents the launch of new instances with IMDSv1 but doesn't block API calls from existing instances that might still be using IMDSv1. The question asks to block any AWS API calls originating from EC2 instances that do not use IMDSv2. The ec2:MetadataHttpPutResponseHopLimit condition key relates to the hop limit for the IMDSv2 token, not whether IMDSv2 is enforced. There is no ec2:RoleDelivery condition key.