Question

A large enterprise uses AWS Organizations with all features enabled across 200 accounts grouped into OUs by business unit. The finance team requires that every EC2 instance and EBS volume be launched with a 'CostCenter' tag so charges can be allocated accurately. A security review found that developers frequently forget to apply the tag, and the tag is often applied incorrectly after resources are running, making chargeback reports inaccurate. The Cloud Center of Excellence wants to prevent the creation of these resources entirely if the required tag is missing, and enforce this uniformly across all member accounts without relying on developers or account administrators to opt in. Which approach best meets these requirements?

Accepted Answer

Attach a Service Control Policy to the organization root that denies ec2:RunInstances and ec2:CreateVolume actions when the aws:RequestTag/CostCenter condition key is not present in the request.

Answer

Enable AWS Config with a required-tags managed rule in every account and use an SSM Automation remediation to add the CostCenter tag to any noncompliant resource.

Answer

Create a tag policy in AWS Organizations that specifies the allowed values for the CostCenter tag and attach it to each business-unit OU.

Answer

Use an IAM permission boundary applied to all developer roles that requires the CostCenter tag on resource creation.