A company is managing multiple AWS accounts using AWS Organizations.

Apply an 1AM policy to all 1AM entities in the account with a statement to explicitly deny NotAction: s3:

Configure AWS Config to terminate compute resources that have been created in the accounts.

Configure AWS CloudTrail to block any action where the event source is not s3.amazonaws.com.

Update the service control policy on the account to deny the unapproved services.