Implement an SCP that targets all AWS accounts, permitting IAM actions solely for administrator roles, and apply this SCP to the root organizational unit (OU).

Set up AWS CloudTrail to trigger an AWS Lambda function for every IAM action event. Configure the Lambda function to block the action if the initiating user is not an administrator.

Develop an SCP that targets all AWS accounts, denying IAM actions for all users except those with administrator roles, and apply this SCP to the root organizational unit (OU).

Establish an IAM permissions boundary that authorizes IAM actions and attach this boundary to every administrator role across all AWS accounts.