Mandatory access control is the correct option.

The policy described matches the confidentiality rules enforced by Mandatory access control. In this model the system assigns fixed security labels to data and clearances to users and it enforces rules centrally. The Bell LaPadula model captures the confidentiality principles no read up and no write down and it is commonly implemented using mandatory controls to prevent reading higher classifications and writing to lower classifications.

Role based access control focuses on roles and permissions granted to users based on their job functions. It does not by itself enforce fixed label based confidentiality rules and it will not inherently prevent reading above a clearance or writing to a lower classification.

Cloud Identity and Access Management is a service for managing identities and permissions in cloud platforms. It is an implementation for access management rather than a label driven confidentiality model and it does not by default implement the strict no read up no write down rules described.

Attribute based access control uses attributes about users resources and the environment to make decisions and it is very flexible. Although ABAC can be configured to approximate label based policies the classic strict clearance and classification rules described are the hallmark of mandatory access control and that makes MAC the best answer for this scenario.

Full AWS Practitioner Certification Question