A company is running a new workload across accounts in an organization in AWS Organizations. All running resources must have a tag of CostCenter, and the tag must have one of three approved values…

Question

Options

• AUse AWS Config custom policy rule and an SCP to deny non-approved
• BUse CloudTrail + EventBridge + Lambda to block creation.
• CEnable tag policies, define allowed values, enforce noncompliant operations, and use an SCP to
• DEnable tag policies and use EventBridge + Lambda to block changes.

• A
  7% (2)
• B
  19% (5)
• C
  70% (19)
• D
  4% (1)

Explanation

AWS Organizations tag policies are designed to standardize and govern tag keys and allowed values across accounts. AWS Certified Security - Specialty documentation describes tag policies as a governance mechanism that helps enforce consistent tagging by specifying required tag keys and permitted values. To ensure every resource has the CostCenter tag at creation time, an SCP can deny create actions when aws:RequestTag/CostCenter is missing (null). This prevents resources from being created without the required tag. Tag policies then define the three approved values and can be configured to enforce or report noncompliance depending on supported services, ensuring that tag values remain within the allowed set and preventing drift to unapproved values. Compared with custom Lambda-based enforcement, this approach minimizes operational overhead and keeps enforcement within AWS native governance services. Option A partially addresses allowed values at request time but does not address ongoing governance as cleanly across many services. Option B is not preventive because Lambda runs after events and cannot reliably block all creations. Option D still relies on custom logic and is not as operationally efficient as tag policies plus SCP guardrails.

No community discussion yet for this question.