Question

A large enterprise uses AWS Organizations with over 200 accounts. The security governance team wants to reduce untracked cloud spend by ensuring that no EC2 instances or EBS volumes can be created unless they include a mandatory 'CostCenter' tag at creation time. This restriction must apply to all member accounts (including future accounts) but must NOT prevent the organization's central automation role, 'OrgProvisioningRole', from creating resources without the tag during bootstrap operations. Which approach enforces this requirement with the least ongoing administrative effort?

Accepted Answer

Attach an SCP to the organization root that denies ec2:RunInstances and ec2:CreateVolume when the 'CostCenter' tag is absent, using a condition with aws:PrincipalARN (via ArnNotLike) to exclude the OrgProvisioningRole.

Answer

Deploy a Config conformance pack to all accounts that flags untagged EC2 instances and volumes, then use an SSM automation remediation to terminate any noncompliant resources.

Answer

Create an IAM permission boundary in every account that denies resource creation without the 'CostCenter' tag, and manually attach it to all IAM roles except OrgProvisioningRole.

Answer

Use a tag policy in AWS Organizations to require the 'CostCenter' tag on EC2 instances and EBS volumes, which will block creation of any noncompliant resources.