A company uses AWS Organizations with all features enabled. Administrators in member accounts currently have broad IAM permissions. The company must prevent ordinary IAM principals in an organizational unit from disabling CloudTrail, even when those principals have AdministratorAccess. Which approach is most appropriate?

1. Attach an SCP to the organizational unit that explicitly denies the relevant CloudTrail disabling and deletion actions.
2. Use a CloudWatch alarm to recreate each trail after an administrator disables it.
3. Attach an IAM permissions policy denying CloudTrail changes to the organization's management-account root user.
4. Attach a permissions boundary to one monitoring role in each member account.