Within an AWS Organization, the company requires that S3 buckets in all production accounts never be deletable. What is the SIMPLEST way for a SysOps administrator to enforce that no S3 buckets in those accounts can be deleted?

The simplest and most effective way to prevent S3 bucket deletion across multiple production accounts in an AWS Organization is by using a Service Control Policy (SCP). An SCP allows you to centrally manage permissions for all accounts within your organization, or specific OUs. By attaching an SCP that explicitly denies the s3:DeleteBucket action to the production accounts or their organizational unit (OU), you ensure this restriction applies to all users and roles within those accounts, regardless of their individual IAM policies. MFA Delete is a bucket-level setting and would need to be enabled on every single bucket, which is not scalable or simple for many accounts. Creating an IAM group with a deny policy would only affect users assigned to that group within each account, and would not prevent root users or other roles from deleting buckets. AWS Shield is a DDoS protection service and has no functionality related to S3 bucket deletion permissions.