Enforcing EC2 Tag Presence and Values in AWS Organizations

SAA-C03 By islever Editorial Last updated Oct 17, 2026

Short answer

AD Use an Organizations Tag Policy to enforce tag values and an SCP to deny instance creation without the tag.

Question

A company is designing the architecture for a new mobile app that uses the AWS Cloud. The company uses organizational units (OUs) in AWS Organizations to manage its accounts. The company wants to tag Amazon EC2 instances with data sensitivity by using values of sensitive and nonsensitive. IAM identities must not be able to delete a tag or create instances without a tag. Which combination of steps will meet these requirements? (Choose two.)

In Organizations, create a new tag policy that specifies the data sensitivity tag key and the required values. Enforce the tag values for the EC2 instances. Attach the tag policy to the appropriate OU. Correct Answer
In Organizations, create a new service control policy (SCP) that specifies the data sensitivity tag key and the required tag values. Enforce the tag values for the EC2 instances. Attach the SCP to the appropriate OU.
Create a tag policy to deny running instances when a tag key is not specified. Create another tag policy that prevents identities from deleting tags. Attach the tag policies to the appropriate OU.
Create a service control policy (SCP) to deny creating instances when a tag key is not specified. Create another SCP that prevents identities from deleting tags. Attach the SCPs to the appropriate OU. Correct Answer
Create an AWS Config rule to check if EC2 instances use the data sensitivity tag and the specified values. Configure an AWS Lambda function to delete the resource if a noncompliant resource is found.

Key Takeaways

Tag policies validate tag values but cannot deny actions; SCPs can deny actions based on missing tags but cannot enforce specific tag values.

This guide explains how to enforce tag presence using Service Control Policies (SCPs) and tag value compliance using AWS Organizations Tag Policies for EC2 instances.

Common mistake: Learners often select B, believing SCPs can enforce tag values, or C, believing Tag Policies can deny API calls.

Expert Analysis

Why the Answer Is Correct

To meet both requirements, you must combine two distinct mechanisms. First, use an SCP (Option D) to deny the RunInstances action if the required tag key is not present, ensuring every instance has a tag. Second, use an Organizations Tag Policy (Option A) to restrict the allowed values for that tag key (e.g., 'sensitive' vs 'nonsensitive'), preventing invalid values. Tag Policies are designed specifically for value validation, while SCPs are designed for access control.

Why the Other Options Are Wrong

Option B is incorrect because SCPs cannot enforce values; they only check for the presence of tags to allow/deny actions. Option C is incorrect because Tag Policies cannot deny API actions like RunInstances; they only define valid tag keys and values. Option E is reactive and complex, failing to prevent non-compliant resources from being created in the first place.

Community Comment Notes

Community consensus strongly supports AD. As LeonSauveterre noted, "SCPs cannot directly enforce tag values," clarifying the separation of concerns. Another commenter highlighted that "Tag policies in AWS Organizations can't deny actions," confirming why C is wrong. The distinction between enforcing presence (SCP) versus values (Tag Policy) is the core concept tested here.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always separate 'presence' enforcement from 'value' enforcement. Use SCPs to gate API actions based on tag existence, and Tag Policies to define the dictionary of acceptable tag values.

Frequently Asked Questions

Why can't I use just one Tag Policy?

Tag Policies only validate tag values and keys; they cannot deny API actions like RunInstances if a tag is missing.

Can SCPs enforce specific tag values like 'sensitive'?

No. SCPs can only check if a tag exists or not. To restrict values, you must use an Organizations Tag Policy.

More SAA-C03 FAQ →

Community Votes

100%

100% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

jingen11 👍 4

A: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_tagging.html D: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_tagging.html
Rayan999 👍 3

Ofcourse A and D. B is little bit close to the answer but its not
LeonSauveterre 👍 2

B - SCPs cannot directly enforce tag values; they can only allow or deny actions based on tags. C - Tag policies in AWS Organizations can't deny actions, such as launching untagged instances or deleting tags. E - AWS Lambda is definitely irrelevent.
FlyingHawk 👍 1

As depicted in this aws blog https://aws.amazon.com/blogs/mt/implement-aws-resource-tagging-strategy-using-aws-tag-policies-and-service-control-policies-scps/ A - Tag Policy only enforces the accepted value of a tag, and not its presence. (step 1) D - SCP Policies enforce the presence of tag. (step 2 and 3)
viejito 👍 3

Respuesta A D .

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide