A SaaS enterprise with 80 AWS accounts needs mandatory owner and cost-center tags on EC2 and RDS, must block noncompliant launches and surface drift for finance chargeback. Which policy-based tagging design enforces cost allocation visibility?
Select an answer to reveal the explanation.
Short Explanation
Tags only pay off when everyone actually uses them consistently. You'll set guardrails that block and correct with tag policies doing the heavy lifting. Prevention plus detection keeps finance chargeback clean.
Full Explanation
Tag policies in AWS Organizations standardize allowed keys, values, and capitalization, an SCP with Null and StringNotLike conditions on aws:RequestTag and aws:ResourceTag denies EC2 RunInstances and RDS CreateDBInstance when required tags are missing, and AWS Config managed rules such as required-tags with auto-remediation flag or fix drift on existing resources for reporting. This layered prevent-and-detect model enforces allocation at creation and sustains it over time. Service Quotas with Trusted Advisor and Budgets can alert on spend and limits but cannot block API calls or standardize tag values. IAM permission boundaries with Secrets Manager and Shield control privilege scope and secrets but do not enforce tag taxonomy or deny untagged provisioning centrally. Resource Groups with CloudTrail Insights and Athena enable search and analysis but provide no policy enforcement or automatic correction. For the exam, remember tag policies define, SCPs enforce at request time, and Config detects, and in practice test SCP effects in a sandbox OU and tag Cost Allocation Tags as active for billing.