A company's AWS account users are launching Amazon EC2 instances without required cost allocation tags. A SysOps administrator needs to prevent users within an organization in AWS Organizations from launching new EC2 instances that do not have the required tags. The solution must require the least possible operational overhead. Which solution meets these requirements?
A) Set up an AWS Lambda function that will initiate a run instance event and check for the required tags. Configure the function to prevent the launch of EC2 instances if the tags are missing.
B) Set up an AWS Config rule to monitor for EC2 instances that lack the required tags.
C) Set up a service control policy (SCP) that prevents the launch of EC2 instances that lack the required tags. Attach the SCP to the organization root.
D) Set up an Amazon CloudWatch alarm to stop any EC2 instances that lack the required tags.

Question

Quizplus · Accepted Answer

Service control policies (SCPs) can be used to enforce tag compliance by preventing the launch of EC2 instances without the required tags, and they apply to all accounts in an organization, minimizing operational overhead.

A Company's AWS Account Users Are Launching Amazon EC2 Instances