A Company Has Multiple AWS Accounts

Multiple Choice

A company has multiple AWS accounts. The company uses AWS Organizations with an organizational unit (OU) for the production account and another OU for the development account. Corporate policies state that developers may use only approved AWS services in the production account. What is the MOST operationally efficient solution to control the production account?

A) Create a customer managed policy in AWS Identity and Access Management (IAM) . Apply the policy to all users within the production account.
B) Create a job function policy in AWS Identity and Access Management (IAM) . Apply the policy to all users within the production OU.
C) Create a service control policy (SCP) . Apply the SCP to the production OU.
D) Create an IAM policy. Apply the policy in Amazon API Gateway to restrict the production account.