A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company needs an automated process across all AWS accounts to isolate any compromised Amazon EC2 instances…

AWS CloudFormation StackSets enable the centralized deployment of identical CloudFormation templates across all target accounts within an AWS Organization, ensuring the automated isolation mechanism is consistently available everywhere.

An SCP with a `Deny` statement for all `ec2:*` actions based on a tag is overly restrictive and could prevent legitimate management actions on the instance itself, rather than just isolating its interaction with other services.

Attaching an overly broad SCP (like the one in B) to the root of the organization can impact all accounts, including the management account, and is not a granular way to isolate specific compromised instances.

This option is truncated but similar to E; creating an EC2 instance role that effectively revokes permissions is a valid isolation step, but the phrasing is incomplete.

An AWS CloudFormation template that creates an EC2 instance role with minimal or no IAM permissions provides a 'quarantine' role. This role can be programmatically assigned to a compromised instance (e.g., via a Lambda triggered by a tag event), effectively revoking its access to other AWS services as an isolation measure.