Question

A security engineer must continuously evaluate whether all Amazon EC2 instances across the organization carry a mandatory 'CostCenter' tag AND that the tag value matches one of a dynamic list of approved cost centers maintained in an external DynamoDB table. AWS Config is already enabled org-wide via a delegated administrator account. Which approach meets these requirements with the least ongoing operational overhead while remaining evaluable by AWS Config?

Accepted Answer

Author a custom AWS Config rule backed by a Lambda function that reads the approved cost-center list from the DynamoDB table and returns COMPLIANT/NON_COMPLIANT for each EC2 configuration item, deployed org-wide as an organization Config rule.

Answer

Deploy the AWS Config managed rule 'required-tags' via a conformance pack to all accounts, specifying the CostCenter tag key and a static comma-separated list of approved values.

Answer

Create an SCP that denies ec2:RunInstances unless a CostCenter tag condition key is present, and rely on the deny to enforce compliance.

Answer

Enable Security Hub's Foundational Security Best Practices standard, which includes a control that validates required resource tags against an external data source.