Question

A security governance team at a company with 200+ AWS accounts under AWS Organizations needs to ensure that all resources are tagged with a standardized 'CostCenter' key that only accepts a defined set of allowed values, and that noncompliant tags are reported centrally. The team wants a native Organizations capability that standardizes tag keys and values across accounts without writing custom code. Which approach best meets this requirement?

Accepted Answer

Attach an AWS Organizations tag policy defining the 'CostCenter' key with allowed values, and review noncompliant resources via the tag policy compliance reports

Answer

Create a service control policy (SCP) that denies all resource creation actions unless the request includes a 'CostCenter' tag matching an allowed value

Answer

Deploy an AWS Config managed rule 'required-tags' via a conformance pack to every account to enforce the 'CostCenter' tag values

Answer

Use IAM permission boundaries on all roles requiring a matching 'CostCenter' condition key for every tag-supporting API call