Create an IAM role in one account under the DataOps OU. Use the ec2:InstanceType condition key in an inline

policy on the role to restrict access to specific instance types.

Create an IAM user in all accounts under the root OU. Use the aws:RequestedRegion condition key in an inline

policy on each user to restrict access to all AWS Regions except ap-northeast-1

Create an SCP Use the aws:RequestedRegion condition key to restrict access to all AWS Regions exceptap- northeast-1.Apply the SCP to the root OU

Create an SCP. Use the ec2:Region condition key to restrict access to all AWS Regions except ap- northeast-1.

Apply the SCP to the root OU,the DataOps OU,and the Research OU

Create an SCP. Use the ec2:InstanceType condition key to restrict access to specific instance types.

Apply the SCP to the DataOps OU