A 400-person fintech runs 60 AWS accounts for payments, analytics, and dev sandboxes under Organizations. Finance must allocate spend by department and environment, and security must find all prod databases quickly. Tagging is inconsistent and manual. Which tagging control best delivers consistent grouping for management?
Select an answer to reveal the explanation.
Short Explanation
You’re managing 60 accounts, so you need guardrails rather than sticky notes. Tag policies standardize tag keys and values, an SCP can require tags at creation, and Config rules flag drift.
Full Explanation
Organizations tag policies standardize tag keys, allowed values, and capitalization across member accounts. An SCP that denies resource creation when department, cost center, or environment request tags are missing makes those tags mandatory at launch, while AWS Config required-tags rules detect noncompliant resources; consistent tags then support management grouping and cost allocation. Resource Groups with tag filters and Cost Explorer reports only organize and report on existing tags, so they do not prevent missing or inconsistent tags and remain unreliable at scale. Service Catalog TagOptions apply only to Service Catalog provisioned products, leaving resources created through other paths unmanaged by that control. Department and environment name prefixes with Resource Explorer searches are brittle, lack policy enforcement and cost-allocation linkage, and fail when names are mistyped or changed. Exam caveat: tag policies enforce key and value syntax but do not require tags to exist or automatically remediate noncompliance; pair them with Config rules and a remediation process. Practical check: test the policy in a sandbox OU and confirm that missing-tag creation attempts are blocked and Config reports noncompliant resources before enforcing the controls in production OUs.