Fabrikam Games allows its DevOps group to create IAM roles for EC2 workloads. Security must ensure any role they create cannot exceed a defined set of permissions (read-only to the DynamoDB table Scores and publishing to CloudWatch Logs), regardless of what policies DevOps attaches later. What is the MOST effective approach?

The most effective approach is to enforce the use of a permissions boundary during role creation. By attaching an IAM policy to the DevOps group that allows iam:CreateRole and role updates only if a specific permissions boundary is included in the request (using a Condition on iam:PermissionsBoundary), you ensure that any role created by DevOps cannot exceed the permissions defined in that boundary. This boundary acts as an upper limit on the role's effective permissions, regardless of any inline or managed policies subsequently attached to the role. Attaching a permissions boundary to each DevOps user would only constrain the user's own permissions, not the permissions of roles they create. An SCP applied to the DevOps OU would affect all principals within the OU, which might be overly restrictive and doesn't directly control the permissions of roles created by DevOps. A DynamoDB table resource policy would only control access to that specific table, not the broader permissions of the roles themselves.