Your company owns an AWS Private Marketplace where third-party software is managed. The AWS Organization includes multiple Organizational Units (OUs). You need to ensure that only an IAM role from the procurement OU can access or configure the Private Marketplace, such as adding or removing products. Which option is the most suitable?

Answer options:

A.Add the AWS Private MarketplaceAdminFullAccess permission to the specific IAM role.
B.Apply an SCP that allows Private Marketplace full access to the procurement OU.
C.Configure the AWS Private Marketplace to deny incoming requests unless the user is the IAM role.
D.Apply an SCP to restrict access to the Private Marketplace for all the organizational units. Ensure that only the IAM role from the Procurement OU has access to the Private Marketplace.

Correct Answer – D
An SCP restricts permissions for IAM users and roles in member accounts, including the member account`s root user. Any account has only those permissions permitted by every parent above it.
If permission is blocked at any level above the account, either implicitly (by not being included in an 
Allow
 policy statement) or explicitly (by being included in a 
Deny
 policy statement), a user or role in the affected account can`t use that permission, even if the account administrator attaches the 
AdministratorAccess
 IAM policy with */* permissions to the user.
If a user or role has an IAM permission policy that grants access to an action that is also allowed by the applicable SCPs, the user or role can perform that action.
Option A is incorrect: Because other IAM roles can also have this permission. There are no restrictions for other IAM entities.
Option B is incorrect: Because the question states that only the "IAM role from the procurement OU can access or configure the Private Marketplace" and therefore applying the SCP that allows Private Marketplace full access to the Procurement OU is incorrect here.
Option C is incorrect: Because AWS Private Marketplace does not have this configuration.
Option D is CORRECT: With the SCP, you can deny the Private Marketplace access unless the AWS principal is the IAM role.
Reference:
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_type-auth.html