An organization uses AWS Organizations and must restrict EC2 instance creation to an approved set of AWS Regions only. The administrator needs to stop anyone in the company from launching EC2 instances in disallowed Regions. What is the most operationally efficient way to enforce this policy across all member accounts?

Creating a service control policy (SCP) at the organization root that denies ec2:RunInstances in unauthorized Regions is the most operationally efficient method. SCPs are a feature of AWS Organizations that allow you to centrally manage permissions for all accounts in your organization. When attached to the root, the policy applies to all member accounts, preventing any user or role from performing the disallowed action, even if their IAM policies would otherwise permit it. This provides a strong, centralized, and scalable control. The other options are less efficient or effective: CloudTrail, EventBridge, and Lambda for termination is reactive, not preventive, and requires complex setup and maintenance across many Regions. Attaching managed IAM policies to groups in each account is decentralized, prone to error, and requires manual effort for every account and group. IAM permissions boundaries are applied to individual users/roles, not accounts, making them less comprehensive and requiring per-user management.