An organization has 10 AWS accounts in AWS Organizations. Each account runs AWS Config and belongs to either the Prod OU or the NonProd OU. Each account has an EventBridge rule that notifies an SNS topic when an EC2 security group inbound rule is created with source 0.0.0.0/0; the security team subscribes to the SNS topic. For all NonProd OU accounts, the security team must remove the ability to create security group inbound rules that allow 0.0.0.0/0. Which approach achieves this with the LEAST operational overhead?

The correct answer is to create a Service Control Policy (SCP) that explicitly denies the ec2:AuthorizeSecurityGroupIngress action when the aws:SourceIp condition equals 0.0.0.0/0, and then apply this SCP to the NonProd OU. SCPs are a powerful feature of AWS Organizations that allow you to centrally manage permissions across multiple accounts. By denying the action at the organizational unit level, you prevent any account within that OU from creating such a rule, regardless of individual IAM permissions. This is the most effective and least operationally intensive solution because it enforces the restriction proactively and centrally. Changing the EventBridge rule to call a Lambda function that removes the offending rule is reactive, not preventive, and adds operational overhead for managing the Lambda function. Attaching a managed AWS Config rule is also reactive and only reports non-compliance; it doesn't prevent the action. An SCP that allows ec2:AuthorizeSecurityGroupIngress only when aws:SourceIp is not 0.0.0.0/0 would be complex to implement correctly and might inadvertently block legitimate ingress rules. A deny SCP is simpler and more robust for this specific requirement.