The company is organized into teams, each owning an AWS account within an AWS Organizations organization. Teams must retain full admin privileges in their own accounts, but they may only use AWS services that have been approved through a request-and-approval process. How should a DevOps engineer enforce this policy across accounts?

The correct answer is to create an explicit allow Service Control Policy (SCP) and attach it to the organization root. SCPs are a powerful way to enforce maximum permissions at the organizational unit (OU) or account level, overriding any IAM policies within the accounts. An explicit allow SCP ensures that only approved services can be used, effectively disallowing all others. Removing the default FullAWSAccess SCP is crucial because SCPs are evaluated in a hierarchical manner, and the default SCP would otherwise grant full access, negating the new explicit allow policy. Incorrect options: Deploying IAM policies via CloudFormation StackSets is less effective because teams with admin privileges could modify or delete these IAM policies within their accounts, circumventing the control. AWS Control Tower and IAM Identity Center manage access but don't inherently restrict service usage at the organizational level in a way that prevents administrators from overriding. Deny policies on user roles are also susceptible to modification by account administrators. Placing accounts into a new top-level OU and attaching a deny SCP is a valid approach for disallowing specific services, but an explicit allow SCP is generally more robust for a "only approved services" policy, as it automatically disallows future unapproved services.