QuestionQ1
Security and ComplianceA company uses an AWS Organizations organization to manage its 500 AWS accounts. All features are enabled in the organization, and the AWS accounts reside in a single OU. Developers must use the CostCenter tag key for every resource in the organization's member accounts. Some teams do not use the CostCenter tag key when tagging their Amazon EC2 instances.
The cloud team created a script that scans all EC2 instances in the organization's member accounts. When an EC2 instance lacks a CostCenter tag key, the script notifies the AWS account administrators. To prevent receiving this notification, some developers apply the CostCenter tag key with an arbitrary string as its tag value.
The cloud team must ensure that every EC2 instance in the organization uses a CostCenter tag key with the correct cost center value.
Which solution meets these requirements?
- A Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Update the script to scan the tag keys and tag values. Modify the script to update noncompliant resources with a default approved tag value for the CostCenter tag key.
- B Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Update the script to scan the tag keys and tag values and notify the administrators when the tag values are not valid.
- C Create an SCP that prevents the creation of EC2 instances without the CostCenter tag key. Attach the policy to the OU. Create an IAM permission boundary in the organization's member accounts that restricts the CostCenter tag values to a list of valid cost centers.
- D Create a tag policy that requires the CostCenter tag to be values from a known list of cost centers for all EC2 instances. Attach the policy to the OU. Configure an AWS Lambda function that adds an empty CostCenter tag key to an EC2 instance. Create an Amazon EventBridge rule that matches events to the RunInstances API action with the Lambda function as the target.
Community Discussion