SCS-C03 practice question: Tagging strategy and tag policies
Security Foundations and Governance A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A software company has 35 AWS accounts, and its finance team uses a CostCenter tag to allocate cloud spending. Teams have written CostCenter values in different styles, such as Finance, finance, and FIN-01. Reports break when a value does not match the approved list exactly.
The FinOps lead wants resource creation to keep working in every account, and wants only approved values accepted for CostCenter on resources where the tag can be enforced. Checking should cover all accounts from one place.
Which solution meets these requirements?
Choose one answer.
AA. Attach an SCP to every account that denies creating resources without a CostCenter tag. Let teams use any value they want, since the SCP checks only that the key is present.
BB. Run a nightly Lambda function that scans every account and rewrites each CostCenter value to the approved spelling. Teams will see their tags corrected by the next morning, and the reports will match the list.
CC. Use an AWS Config rule that marks resources as noncompliant when the CostCenter tag is missing, and send alerts to the teams. Leave the existing values alone, since the rule checks presence rather than spelling.
DD. Create a tag policy in AWS Organizations with the approved CostCenter values, enforced on supported resource types, and attach it to the root so that every account is covered.
Show the answer and explanation
Answer: D
A. Wrong: An SCP that requires the key cannot check the approved values, so the spelling mismatches continue. It also blocks creation of untagged resources, which the FinOps lead wants to keep working.
B. Wrong: Rewriting tags after the fact means reports are wrong until the next run. The function also changes values that teams set on purpose, and it must be maintained across 35 accounts.
C. Wrong: A presence rule checks that the key exists, so it cannot flag values written in the wrong style. The FinOps lead needs the approved values checked, not only the key.
D. Right: Correct. A tag policy defines the exact key and approved values, and enforcement rejects non-approved values on supported resource types. Attaching it to the root applies the rule to all accounts without blocking resources created without the tag. Learn more: Tag policies in AWS Organizations (opens in a new tab)
Explanation
Tag policies in AWS Organizations define the allowed keys and values, and enforcement rejects values outside the list for supported resources. Attaching the policy at the root covers every account from one place. Presence checks, SCPs that require the key, and after-the-fact rewrites each miss part of the requirement.
Want more on Tagging strategy and tag policies? The 5 full-length practice sets have 5 more Tagging strategy and tag policies questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →