Question

A large enterprise operates roughly 200 accounts under AWS Organizations, grouped into OUs for Production, Development, and Sandbox. The FinOps team reports that a growing percentage of EC2 and RDS resources launch without a mandatory 'CostCenter' tag, which breaks their chargeback reporting. Leadership wants a preventive control that stops noncompliant resource creation at the organizational level, but they require that AWS service-linked roles and automated backup/recovery service actions are never blocked by this control. Which approach best meets these requirements?

Accepted Answer

Attach an SCP to the OUs that denies ec2:RunInstances and rds:CreateDBInstance when the aws:RequestTag/CostCenter key is absent, using a condition and an exception for service-linked roles via aws:PrincipalArn.

Answer

Attach a Tag Policy at the Organizations root that enforces the 'CostCenter' tag key, relying on it to reject resource creation when the tag is missing.

Answer

Enable AWS Config with a required-tags managed rule and an auto-remediation action that terminates any resource missing the 'CostCenter' tag.

Answer

Create an IAM permission boundary requiring the 'CostCenter' tag and attach it to every IAM role in all member accounts through Account Factory.