Question

A global enterprise runs 200 accounts under AWS Organizations across multiple OUs. The finance team reports that cost allocation reports are unreliable because teams apply inconsistent tag keys and values (e.g., 'CostCenter', 'costcenter', 'Cost_Center') to their resources. Leadership wants a centralized way to define approved tag keys and permitted values, and to report on which resources are non-compliant, without preventing resource creation. Which approach best meets these requirements?

Accepted Answer

Enable tag policies in AWS Organizations to define standardized tag keys and allowed values, and use the compliance reporting to identify non-compliant resources.

Answer

Attach an SCP to the root OU that denies resource creation unless the correct 'CostCenter' tag key and value are present.

Answer

Deploy AWS Config conformance packs to every account that reject any resource missing the 'CostCenter' tag during creation.

Answer

Use IAM permission boundaries in each account to require tags matching an approved list before allowing resource actions.