An enterprise wants developers to purchase approved third-party software only through a Private Marketplace in AWS Marketplace. The company uses AWS Organizations with all features enabled and has a shared-services account in each OU for procurement managers. Procurement administration must be limited to a role named procurement-manager-role (assumable by procurement managers). All other IAM users, groups, roles, and account administrators must be denied Private Marketplace administrative access. What is the MOST efficient architecture to meet these requirements?

The correct option efficiently centralizes Private Marketplace administration and enforces strict access control. Creating the procurement-manager-role in shared-services accounts with AWSPrivateMarketplaceAdminFullAccess grants the necessary permissions. The root-level SCP with a NotPrincipal condition effectively denies Private Marketplace administration to all principals except the specified role, ensuring only authorized procurement managers can manage it across the entire organization. A second SCP preventing the creation of a role named procurement-manager-role adds a crucial layer of security, preventing unauthorized users from bypassing the first SCP by creating their own role with the same name. Incorrect options: Option 1 is inefficient and complex to manage, requiring policy attachments and inline policies across all accounts and users. It also grants PowerUserAccess, which is overly permissive. Option 2 uses AdministratorAccess, which is too broad, and permissions boundaries don't deny access; they set the maximum permissions. Option 4 applies the SCP only to shared-services accounts, not the entire organization, failing to restrict developers in other accounts. It also places the role in developer accounts, not shared-services.