You are managing Azure subscriptions for your organization. You need to ensure that all resources created in a specific subscription are automatically tagged with a 'CostCenter' tag. If a resource is created without this tag, the creation should be denied. What should you implement?