Developers assume the AWS CDK deployment role to deploy infrastructure that includes Lambda functions and their IAM roles. A security review found the developers and the CDK deployment role have excessive permissions, and the Lambda roles created by CDK are overly permissive. Developers must not be able to grant additional permissions. Which approach meets the requirement with the least operational overhead?

The correct answer effectively limits permissions by using an IAM permissions boundary. By updating the account CDK bootstrapping to use a permissions boundary, all roles created by CDK within that account will automatically be constrained by this boundary, preventing developers from inadvertently or intentionally creating overly permissive roles. This approach has the least operational overhead because it's enforced at the account level during bootstrapping, requiring no manual intervention from developers for each role creation. The first incorrect option, using an SCP to deny iam:CreateRole and iam:UpdateRole, would prevent developers and the CDK deployment role from creating or updating any roles, which is too restrictive and would break CDK's functionality. Centrally creating roles also adds significant operational overhead. The third incorrect option, instructing developers to reference the permissions boundary, relies on developer compliance and is prone to human error, failing to meet the requirement that developers must not be able to grant additional permissions. The fourth incorrect option, using an SCP to deny iam:CreateRole and iam:UpdateRole for developers, still allows the CDK deployment role to create overly permissive roles. Running IAM Access Analyzer is a reactive measure, not a proactive prevention of excessive permissions.