An organization uses AWS Organizations with consolidated billing and OUs for Finance, Sales, HR, Marketing, and Operations. Each department has accounts for dev, test, pre-prod, and production. The HR department purchased Reserved Instances (RIs) in its production account for a system that will launch there. HR needs to ensure other departments cannot share those RI discounts. Which action accomplishes this?

The correct answer is to turn off RI sharing for the HR production account from the organization’s management account. Reserved Instance sharing is an organization-level setting controlled by the management account. By default, RIs purchased by any account in an AWS Organization are shared across all accounts to maximize utilization and cost savings. To prevent sharing for a specific account, this default behavior must be overridden by the management account. Turning off RI sharing in the HR production account's console is incorrect because individual member accounts cannot unilaterally disable RI sharing; it's a management account prerogative. Removing and re-adding the account is overly complex and disruptive, and it doesn't directly address the RI sharing setting. Creating an SCP is incorrect because SCPs control permissions and actions, not the sharing behavior of billing constructs like RIs. RI sharing is a billing configuration, not a permission that can be restricted by an SCP.