A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?
Trap 1: Use AWS Config rules to enforce tagging on existing resources and…
Config rules cannot automatically tag; they can only detect.
Trap 2: Use AWS Cost Explorer to report on untagged resources.
Cost Explorer can report but does not enforce tagging.
Trap 3: Create an IAM policy that requires tagging for all actions and…
Not all actions support tagging; IAM policies are not account-wide.
- A
Use a service control policy (SCP) to deny resource creation without the 'department' tag, and use AWS Config rules to detect untagged resources.
SCPs prevent creation of untagged resources; Config identifies existing untagged resources.
- B
Use AWS Config rules to enforce tagging on existing resources and automatically tag them.
Why wrong: Config rules cannot automatically tag; they can only detect.
- C
Use AWS Cost Explorer to report on untagged resources.
Why wrong: Cost Explorer can report but does not enforce tagging.
- D
Create an IAM policy that requires tagging for all actions and attach it to all users.
Why wrong: Not all actions support tagging; IAM policies are not account-wide.