Use an SCP to require the CostCenter tag, a tag policy for valid values, and update the script to fix noncompliant resources

Why the Answer Is Correct

The problem has three distinct facets and the solution must address each. First, some teams omit the CostCenter tag key entirely, so an SCP that prevents the creation of EC2 instances without the CostCenter tag key closes that gap at the point of creation, and f4b18ba noted this ensures any attempt to launch an instance without the tag is denied from the start, enforcing the requirement at the organizational level. Second, and most importantly for this scenario, developers supply arbitrary values for the tag, so an Organizations tag policy requiring the CostCenter tag to take values from a known list of cost centers is the control that actually validates the value; Srikantha observed that AWS tag policies can enforce allowed values for tag keys. Third, resources created before these controls existed still carry bad values, so the script is updated to scan both tag keys and tag values and to modify noncompliant resources with a default approved value, which corrects the estate rather than only reporting on it. Option A is the only choice containing all three, which is why f4b18ba selected it and why Srikantha's description of the SCP and tag policy roles matches it. A is the correct answer.

Why the Other Options Are Wrong

B creates an SCP preventing EC2 creation without the CostCenter tag key, attaches it to the OU, and updates the script to scan tag keys and values and notify administrators when values are invalid. This leaves the core problem untouched: the SCP only requires that the key be present, so a developer can continue to supply any arbitrary string, and notifying the account administrator neither corrects the instance nor prevents the workaround. Srikantha's description of the tag policy's role in validating values shows precisely what option B omits. C creates the same SCP and adds an IAM permissions boundary in the member accounts that restricts CostCenter tag values to a list of valid cost centers. A permissions boundary caps the API actions a principal is authorized to perform; it has no ability to constrain the value of a tag applied to a resource, so it cannot enforce a valid-value list and the arbitrary-value workaround remains available. D creates a tag policy requiring valid CostCenter values, attaches it to the OU, and configures a Lambda that adds an empty CostCenter tag key to an EC2 instance together with an EventBridge rule matching RunInstances. Adding an empty tag value satisfies neither the tag policy's requirement for a known value nor the need to correct instances that already carry arbitrary values, so this option gates only new RunInstances calls while leaving the existing noncompliant estate and the notification loop unresolved. A is correct.

Community Comment Notes

Community voted A unanimously. f4b18ba explained the role of the SCP, that it denies any attempt to create EC2 instances without the CostCenter tag key from the start, enforcing the requirement at the organizational level, and Srikantha described the complementary tag policy that validates values against a known list of cost centers. Changwha confirmed A. No alternative received support.