SCS-C02 Question 412
Select 2Your company is undergoing a security audit to ensure compliance with industry standards. As part of the audit, you are asked to implement a solution that ensures all AWS resources are tagged according to your organization's tagging policy for cost allocation and governance purposes. Additionally, you must ensure that any resources created without the required tags are flagged or prevented from being deployed. Which combination of AWS services and features can help you achieve this?
- A
AWS Config with custom rules to enforce tagging policies
- B
AWS CloudTrail to monitor API calls for resource creation
- C
AWS Organizations Service Control Policies (SCPs) to enforce tagging compliance
- D
AWS IAM Access Analyzer to audit resource policies for tagging
- E
AWS Tag Editor to retroactively tag untagged resources
Show answer and explanation
Correct answers: A, C
Explanation
To ensure resources are tagged according to your organization's policy and prevent untagged resources from being deployed, you can use AWS Config with custom rules to evaluate compliance and flag non-compliant resources. Additionally, AWS Organizations SCPs can enforce tagging compliance by restricting actions on resources that do not adhere to the policy. CloudTrail, IAM Access Analyzer, and Tag Editor are not suitable for enforcing or preventing non-compliance in this scenario.
- A. Correct.
AWS Config with custom rules allows you to enforce tagging policies by evaluating the compliance of resources with required tags, and it can flag or remediate non-compliant resources.
- B. Incorrect.
AWS CloudTrail monitors API calls but does not enforce resource tagging policies or prevent the creation of untagged resources.
- C. Correct.
AWS Organizations Service Control Policies (SCPs) allow you to define and enforce tagging compliance at an organizational level by restricting actions on resources that do not meet the tagging requirements.
- D. Incorrect.
AWS IAM Access Analyzer audits resource policies but does not enforce or evaluate tagging compliance.
- E. Incorrect.
AWS Tag Editor is used to retroactively tag resources but does not enforce tagging policies or prevent the creation of untagged resources.