Advanced AI Prompt for AWS Organizations Service Control Policy (SCP) Guardrails

Act as an AWS Organizations Security Lead. Generate a strict Service Control Policy (SCP) to be applied to the Organizational Unit [OU_ID]. The SCP must establish three immutable guardrails: 1) Explicitly deny any `*` action in AWS regions other than [DENIED_REGIONS] (e.g., `us-east-1`, `eu-west-1`). 2) Prevent the deletion of EBS snapshots (`ec2:DeleteSnapshot`) unless the assuming principal possesses a specific 'Role' tag equal to 'Admin'. 3) Enforce a tagging policy that blocks `ec2:RunInstances` if the request does not include the '[MANDATORY_TAG_KEY]' tag. Condense the JSON structure to ensure the policy remains well under the strict 5120-byte size limit for AWS SCPs.