A multi-account SaaS company with 40 AWS Organizations accounts cannot allocate shared platform spend because teams omit CostCenter and Environment tags on EC2 and S3 resources. Finance requires preventive enforcement on creation plus detection of existing gaps. Which policy-based tagging enforcement design provides preventive and detective cost allocation coverage?
Select an answer to reveal the explanation.
Short Explanation
You need guardrails that both block and catch gaps, and tag policies plus SCPs and Config give you both. Prevention stops new untagged launches while detection cleans up what's already running.
Full Explanation
Tag policies define the allowed values and standardized capitalization for cost allocation keys across the organization and inherit through OUs, an SCP with Null condition checks on aws:RequestTag denies RunInstances or CreateBucket when required tags are missing which provides preventive enforcement at creation time, and AWS Config rules such as required-tags provide continuous detective evaluation with auto-remediation via Systems Manager. Using only Config rules with SNS alerts satisfies detection but misses the stated preventive requirement because resources can still be created untagged and rely on human follow-up. Activating cost allocation tags and building cost categories improves billing visibility and reporting but does not enforce tagging behavior and therefore leaves creation gaps unresolved. Applying IAM permission boundaries to developers controls maximum permissions delegation but does not standardize tag values organization-wide or evaluate existing resources, so it misses both consistent policy inheritance and detective coverage. Exam caveat is to distinguish tag policies from activation: policies standardize while activation exposes for billing. Practical check is to test the SCP in a sandbox OU with tag policy inheritance and a required-tags Config rule before enforcing on production OUs.