A legacy application uses IAM user credentials to access resources in the company's AWS Organizations organization. It should not be possible to create IAM users unless the user account making the requires is specific on an exception list. A DevOps engineer must apply these restrictions. Which solution will meet these requirements?