A company is using AWS Organizations with all features enabled. The security team wants to ensure that no IAM user or role in any member account can access AWS services in regions other than us-east-1 and eu-west-1. However, they need to ensure that global services like AWS IAM and Amazon CloudFront continue to function normally. How can this be achieved?

Create a Service Control Policy (SCP) that denies all actions with a condition 'aws:RequestedRegion' not equal to us-east-1 or eu-west-1. Add exceptions in the NotAction element for global services.

Use AWS Config rules to detect resources created outside the allowed regions and trigger an SSM Automation document to delete them.

Disable the unauthorized regions in the AWS Management Console for each member account.

Create an IAM permissions boundary that denies access to unauthorized regions and attach it to the root user of the management account.