Question

A security governance team manages an AWS Organization with 200 accounts across multiple OUs. They must ensure that every EC2 instance and EBS volume created by any account carries a 'CostCenter' tag with an approved value, and that non-compliant resource creation is prevented at the point of the API call. The team also wants standardized tag key casing reported across the organization. Which approach best meets these requirements?

Accepted Answer

Use an SCP with a Deny statement conditioned on aws:RequestTag/CostCenter for RunInstances and CreateVolume actions to block untagged creation, and use a Tag Policy to enforce standardized tag key casing and report noncompliance.

Answer

Rely solely on a Tag Policy attached at the organization root to both enforce the presence of the CostCenter tag and block noncompliant API calls.

Answer

Deploy an AWS Config managed rule (required-tags) in every account to prevent creation of untagged EC2 instances and EBS volumes.

Answer

Create an IAM permission boundary in each account that denies RunInstances unless the CostCenter tag is present, and use Cost Allocation Tags for reporting.