An enterprise has a strict compliance requirement that all Amazon EBS volumes must be encrypted. They want to ensure that no unencrypted EBS volumes can be created in their AWS accounts, even by administrators. What is the MOST robust way to enforce this?

Create an IAM policy that denies the ec2:CreateVolume action if the Encrypted flag is false, and attach it to all users.

Use AWS Config to detect unencrypted volumes and trigger a Lambda function to encrypt them.

Enable 'EBS Encryption by Default' at the account level in all regions.

Create an SCP that denies the ec2:RunInstances action.