Enforce EC2 CostCenter Tag via Organizations

SOA-C03 By islever Editorial Last updated

Implement and manage security and compliance tools and policies. Provision and maintain cloud resources.

Short answer

A Create an Organizations policy for the CostCenter tag to prevent noncompliant EC2 launches with least effort.

Question

A company uses AWS Organizations to manage its AWS accounts. The company is implementing a CostCenter tag for business units to track costs and prevent noncompliant actions.
The company needs to prevent users from launching Amazon EC2 instances with a CostCenter tag unless the tag has specified values.
Which solution will meet this requirement with the LEAST administrative effort?
  1. Create a service control policy (SCP) for the CostCenter tag in Organizations. Define the specified values in the policy. Attach the policy to all the company's organizational units (OUs). Correct Answer
  2. Configure inventory collection for the EC2 instances in AWS Systems Manager Inventory. Attach the CostCenter tag to the managed instances.
  3. Create an Amazon Machine Image (AMI) for each of the company's business units. Include a user data script that tags instances when they are launched.
  4. Create an Amazon EventBridge rule that invokes an AWS Lambda function when a user launches an EC2 instance. Configure the Lambda function to apply the appropriate CostCenter tag for each user's IAM role or to terminate the instance if the tag lacks the specified values.

Key Takeaways

This question tests the ability to enforce tagging compliance with least effort; the common trap is choosing a reactive, code-heavy solution like Lambda over a native, preventative Organizations policy.

Using AWS Organizations to enforce tag compliance prevents noncompliant EC2 launches centrally. This page explains why an Organizations policy is the least administrative effort solution for enforcing CostCenter tag values.

Common mistake: Choosing EventBridge and Lambda (D) because it seems flexible, but it requires custom code and is reactive rather than preventative, violating the least administrative effort requirement.

Expert Analysis

Why the Answer Is Correct

Option A leverages AWS Organizations to define and enforce allowed tag values centrally. Whether implemented natively as a Tag Policy or as an SCP using condition keys, it prevents the ec2:RunInstances API call from succeeding if the CostCenter tag is noncompliant. This native, preventative approach requires no custom code and minimal ongoing administration, perfectly meeting the requirement.

Why the Other Options Are Wrong

Option B uses AWS Systems Manager Inventory, which is a monitoring and data collection tool; it cannot prevent noncompliant actions. Option C relies on AMIs and user data scripts, which does not prevent users from launching untagged instances using other AMIs and requires high effort to maintain. Option D uses an EventBridge rule and Lambda function, which is a reactive approach; it requires writing and maintaining custom code and allows noncompliant instances to launch temporarily before termination.

Community Comment Notes

The community agrees that using an Organizations policy is the correct approach, as noted by Bad_Mat who selected option A. This confirms the preference for a native, preventative control over reactive or monitoring-based solutions.

Official Reference

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

For "least administrative effort" questions involving preventative controls or compliance across an organization, always prefer native AWS Organizations policies (SCPs or Tag Policies) over custom Lambda functions or reactive monitoring solutions.

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Bad_Mat 👍 1 Answered A
    A. Create a service control policy (SCP) for the CostCenter tag in Organizations. Define the specified values in the policy. Attach the policy to all the company's organizational units (OUs).

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Resolving Private IPv4 Exhaustion in AWS VPCs

S-grade

How Do You Ramp ALB Traffic Gradually During EC2 Cache Warm-Up?

S-grade

Avoiding Permanent Credentials with AWS STS

S-grade

Automate EC2 Reboot with Systems Manager Maintenance Windows

S-grade

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide