An organization centrally manages hundreds of AWS accounts with AWS Organizations. Product teams now create and manage S3 Access Points in their accounts. All S3 Access Points must be accessible only from VPCs (no internet access). What is the most operationally efficient way to enforce this requirement across the organization?

The correct answer is to create a Service Control Policy (SCP) at the organization root. SCPs are a powerful feature of AWS Organizations that allow you to centrally manage permissions across all accounts in your organization. By applying an SCP at the root, you can enforce the requirement that all S3 Access Points must be accessible only from VPCs, preventing any account from creating an Access Point that violates this rule. The s3:AccessPointNetworkOrigin condition key is specifically designed to control access based on the network origin of the request. Applying an S3 Access Point resource policy is incorrect because it would need to be applied to each individual Access Point, which is not operationally efficient for hundreds of accounts. Using CloudFormation StackSets to deploy IAM policies is less efficient than an SCP because it requires managing deployments and ensuring compliance across all accounts, whereas an SCP is a preventative guardrail. Setting an S3 bucket policy is incorrect because bucket policies apply to the bucket itself, not to the creation of S3 Access Points.