An organization uses AWS Organizations to manage multiple AWS accounts. A solutions architect must enforce a policy where only administrator roles can perform IAM actions across the organization. The architect does not have access to every AWS account. Which approach enforces this with the least operational overhead?

The correct answer is to create a Service Control Policy (SCP) that denies IAM actions for all principals except those with administrator roles and attach it to the root OU. SCPs are a feature of AWS Organizations that allow you to centrally manage permissions across multiple accounts. By attaching this SCP to the root OU, it applies to all accounts within the organization, effectively restricting IAM actions to only administrator roles without needing to access individual accounts. The other options are less suitable: Creating an SCP that allows IAM actions only for administrator roles (first option) is incorrect because SCPs primarily define maximum available permissions; an "allow" SCP wouldn't implicitly deny others. Configuring CloudTrail and Lambda (second option) would be reactive, attempting to deny actions after they occur, which is not a preventative control and significantly increases operational overhead. Defining an IAM permissions boundary (fourth option) requires modifying every administrator role in every account, which is not feasible given the architect's limited access and would incur high operational overhead.