Question

A company must demonstrate to auditors that all EC2 instances, EBS volumes, and RDS instances across a 60-account AWS Organization carry mandatory cost-allocation tags (CostCenter, Owner, Environment). The security team needs a single, auditable compliance report that is continuously updated, and they want to minimize the amount of custom code they build and maintain. Resources that lack required tags must be flagged automatically. What is the MOST operationally efficient way to meet these requirements?

Accepted Answer

Deploy the AWS Config managed rule 'required-tags' via an organization conformance pack from the delegated administrator account, and view aggregated compliance results in a Config aggregator.

Answer

Write a Lambda function invoked on a daily EventBridge schedule in every account that calls the Resource Groups Tagging API, evaluates tags, and writes results to a central DynamoDB table for reporting.

Answer

Enable AWS Security Hub across the organization and rely on the CIS AWS Foundations Benchmark controls to detect resources missing mandatory tags.

Answer

Create a Service Control Policy that denies creation of any resource that does not include the three required tags, then export CloudTrail denied events to Athena for reporting.