A company uses an organization in AWS Organizations to manage the company's AWS accounts. The company uses AWS CloudFormation to deploy all infrastructure. A finance team wants to build a chargeback…

AWS Organizations Tag Policies allow centralized enforcement of tagging rules across all accounts within an organization. By defining a tag policy at the root of the organization that specifies the allowed project tag values, all new resources deployed in any member account will be checked against this policy. This provides a preventative control that ensures compliance with the predefined tag values for chargeback purposes with the least administrative effort, as it's configured once centrally.

Creating a tag policy in each OU and an SCP would be more effort than applying a single tag policy at the root of the organization. An SCP is not necessary for enforcing tag values.

Creating a tag policy in the AWS management account implies it's only active for that account, not the entire organization, unless it's explicitly applied at the root or OUs within AWS Organizations.

While AWS Service Catalog and TagOptions Library can enforce tags for products provisioned through it, this approach would require migrating all existing CloudFormation stack deployments to Service Catalog products, which is a significant effort and not ideal for 'least effort' for all new resources.