Teams use CodeCommit repositories across multiple AWS accounts within an AWS Organization. Developers sign in via IAM Identity Center with an external IdP and assume a developer role to use Git. A security review found developers can modify the main branch of any repository. You must restrict each team so they can only modify the main branch of repositories they own. Which combination of steps will enforce this? (Choose three.)

To restrict main branch modifications to repository owners, a multi-faceted approach leveraging tags and SCPs is required. First, tag each CodeCommit repository with an access-team tag, assigning the owning team's name as its value. This establishes ownership metadata. Second, update the SAML assertion from the external IdP to include the user's team name and modify the IAM role's trust policy to create an access-team session tag with that team name. This propagates the user's team identity into their AWS session. Finally, attach a Service Control Policy (SCP) to the AWS accounts. This SCP will contain a condition that allows main branch modifications only when the principal's aws:PrincipalTag/access-team matches the resource's aws:ResourceTag/access-team, effectively enforcing team-based ownership for main branch changes. Incorrect options: Creating an approval rule template per account or for each team and associating it with all repositories, with the developer role as an approver or a condition, is not sufficient. Approval rules are for pull requests and don't directly restrict direct pushes to the main branch based on team ownership. An IAM permissions boundary limits the maximum permissions an IAM entity can have but doesn't enforce cross-account or resource-based conditions like an SCP does for this specific scenario.