Enforce EC2 CostCenter Tag via Organizations

Implement and manage security and compliance tools and policies. Provision and maintain cloud resources.
Answer Correct answer: A — Create an Organizations policy for the CostCenter tag to prevent noncompliant EC2 launches with least effort.

A company uses AWS Organizations to manage its AWS accounts. The company is implementing a CostCenter tag for business units to track costs and prevent noncompliant actions. The company needs to prevent users from launching Amazon EC2 instances with a CostCenter tag unless the tag has specified values. Which solution will meet this requirement with the LEAST administrative effort?

  1. Create a service control policy (SCP) for the CostCenter tag in Organizations. Define the specified values in the policy. Attach the policy to all the company's organizational units (OUs). Correct Answer
  2. Configure inventory collection for the EC2 instances in AWS Systems Manager Inventory. Attach the CostCenter tag to the managed instances.
  3. Create an Amazon Machine Image (AMI) for each of the company's business units. Include a user data script that tags instances when they are launched.
  4. Create an Amazon EventBridge rule that invokes an AWS Lambda function when a user launches an EC2 instance. Configure the Lambda function to apply the appropriate CostCenter tag for each user's IAM role or to terminate the instance if the tag lacks the specified values.

Community Insight

This question tests the ability to enforce tagging compliance with least effort; the common trap is choosing a reactive, code-heavy solution like Lambda over a native, preventative Organizations policy.

Using AWS Organizations to enforce tag compliance prevents noncompliant EC2 launches centrally. This page explains why an Organizations policy is the least administrative effort solution for enforcing CostCenter tag values.

Choosing EventBridge and Lambda (D) because it seems flexible, but it requires custom code and is reactive rather than preventative, violating the least administrative effort requirement.

Community Discussion (1 comments)

Bad_Mat 👍 1 Selected: A
A. Create a service control policy (SCP) for the CostCenter tag in Organizations. Define the specified values in the policy. Attach the policy to all the company's organizational units (OUs).

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Option A leverages AWS Organizations to define and enforce allowed tag values centrally. Whether implemented natively as a Tag Policy or as an SCP using condition keys, it prevents the ec2:RunInstances API call from succeeding if the CostCenter tag is noncompliant. This native, preventative approach requires no custom code and minimal ongoing administration, perfectly meeting the requirement.

Why the Other Options Are Wrong

Option B uses AWS Systems Manager Inventory, which is a monitoring and data collection tool; it cannot prevent noncompliant actions. Option C relies on AMIs and user data scripts, which does not prevent users from launching untagged instances using other AMIs and requires high effort to maintain. Option D uses an EventBridge rule and Lambda function, which is a reactive approach; it requires writing and maintaining custom code and allows noncompliant instances to launch temporarily before termination.

Community Comment Notes

The community agrees that using an Organizations policy is the correct approach, as noted by Bad_Mat who selected option A. This confirms the preference for a native, preventative control over reactive or monitoring-based solutions.

Official Reference

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html

Exam Strategy

For "least administrative effort" questions involving preventative controls or compliance across an organization, always prefer native AWS Organizations policies (SCPs or Tag Policies) over custom Lambda functions or reactive monitoring solutions.

Related Analysis

A company launches an application. The company hosts the app

S-Grade

A company's website runs on an Amazon EC2 Linux instance. Th

A-Grade

A company has a policy that requires all Amazon EC2 instance

A-Grade

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide