A company is using AWS Organizations to manage multiple accounts. Due to regulatory requirements, the company wants to restrict specific member accounts to certain AWS Regions, where they are…

AWS Config rules are reactive (monitor compliance after deployment) and are not used to proactively limit regions or enforce tag policies for future deployments across multiple accounts from a central point.

Disabling regions from the Billing and Cost Management console applies to the entire organization, not specific member accounts, and does not enforce tagging standards.

Associating accounts directly with the root is less granular than using an OU and might apply policies too broadly if other accounts also need different policies; an OU provides better organizational structure for targeted policies.

Creating a new Organizational Unit (OU) allows for grouping specific member accounts, enabling targeted governance. Applying a Tag Policy to this OU centrally enforces tagging standards across all resources within those accounts, ensuring compliance. Simultaneously, an SCP (Service Control Policy) can be attached to the OU to deny access to actions in unapproved AWS Regions, providing a preventative guardrail for regional restrictions and meeting all requirements with centralized management and minimal configuration.