A company is using AWS Control Tower. They want to ensure that all EBS volumes created in any member account are encrypted with a specific AWS KMS Customer Managed Key (CMK) owned by a central Security account. What is the MOST robust way to enforce this?

Use AWS Config to detect unencrypted volumes and remediate them.

Create an SCP that denies ec2:CreateVolume if the ec2:Encrypted condition is false.

Create an SCP that denies ec2:CreateVolume if the kms:EncryptionContext:aws:ebs:id condition does not match the central CMK ARN.

Create an SCP that denies ec2:CreateVolume if the request does not specify the central CMK ARN.