A company is using multiple AWS accounts and has multiple DevOps teams running production and non-production workloads in these accounts. The company would like to centrally-restrict access to some…

A Deny list strategy, implemented with Service Control Policies (SCPs) in AWS Organizations, allows you to explicitly deny access to specific AWS services while implicitly allowing everything else, which is suitable for restricting a few services.

IAM Access Advisor shows the last time services were accessed by IAM entities, helping to identify which services are currently in use so that you can avoid disrupting operations when applying new restrictions with SCPs.

AWS Trusted Advisor provides recommendations on cost optimization, security, and performance, but it does not directly show which services are actively being used by IAM principals for the purpose of defining SCPs, making Access Advisor more appropriate.

Removing the default `FullAWSAccess` SCP is not strictly necessary to implement a Deny list, as `Deny` statements in SCPs always override `Allow` statements; however, it is often done when moving to a stricter Allow-list model.

Defining Organizational Units (OUs) and placing member accounts into them provides a logical grouping structure, enabling you to apply SCPs and other policies to multiple accounts as a single administrative unit, meeting the requirement for centralized management.

There is no default `DenyAWSAccess` SCP in AWS Organizations; the default policy is `FullAWSAccess`, which allows all actions unless explicitly denied by other SCPs.