A financial services company runs 40 AWS accounts in a single organization in AWS Organizations with all features enabled. A recent audit produced two mandatory, non-negotiable controls:
1. Account administrators in member accounts must not be able to remove their account from the organization. 2. Workloads must only create resources in eu-west-1 and eu-central-1, while global services such as IAM, AWS Organizations, Amazon CloudFront, and Amazon Route 53 must keep working.
Each member account has its own local administrators who can create IAM roles and users at will. The controls must be preventive, must survive an account administrator editing local IAM policies, and must apply automatically to accounts added later. Which approach meets these requirements with the least ongoing operational effort?