Tagging strategy and tag policies: SCS-C03 study notes and practice questions
What to know about Tagging strategy and tag policies for the SCS-C03 exam, from the Security Foundations and Governance domain (14% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a rule such as “every resource needs an owner tag,” “production data must carry a classification tag,” or “a team may stop only the resources it owns.” Each rule needs a different tagging tool, so read the verb closely: standardize, enforce, or use tags for access.
What decides the answer
Tag policies define the allowed tag keys, their capitalization, and the allowed values for supported resources across accounts. You attach them from the management account. They report noncompliant resources. With enforcement turned on for a resource type, they also reject tagging requests that use a noncompliant value, but they never stop a resource from being created without the tag.
Enforcing tags at creation uses IAM or SCP conditions. The condition key aws:RequestTag checks tags supplied in the request, aws:TagKeys checks which tag keys a request may add or remove, and aws:ResourceTag checks tags already on a resource. A deny that fires when the request has no owner tag is the usual pattern.
Tags for access control are covered in the ABAC topic. When tags grant access, restrict who can change them with aws:TagKeys or a deny on the tag keys that control access.
Cost allocation tags appear in cost reports only after you activate them in the Billing console. Activation is a common missing step.
Tag Editor and the Resource Groups Tagging API find and change tags across resources and Regions, which helps when you need a list of untagged resources.
Tags are not secret. Anyone who can read a resource can usually read its tags, so never put credentials or sensitive values in them.
How to choose
Scenario wording
Pick
Standardize tag key names and allowed values across every account
Tag policy
Stop creation of any resource that has no owner tag
SCP or IAM policy with aws:RequestTag
One policy that lets each team manage only its own resources
ABAC with aws:ResourceTag and principal tags
Break down the monthly bill by team
Cost allocation tags, activated in Billing
Find untagged or mis-tagged resources across accounts
Tag policy compliance report, or Tag Editor
Common traps
Expecting tag policies to block untagged resources. They report, and with enforcement they reject noncompliant tag values. Blocking creation without a tag needs an SCP or an IAM condition.
Using tags as a security boundary without restricting who may change them.
Forgetting to activate cost allocation tags and then expecting costs to be grouped by tag.
Storing secrets in tags.
Inconsistent casing, such as Owner and owner, which breaks both ABAC and cost reports. Tag policies catch this.
Using tags to enforce data residency when the requirement is a Region control. Use an SCP or RCP for Region restrictions.
A software company has 35 AWS accounts, and its finance team uses a CostCenter tag to allocate cloud spending. Teams have written CostCenter values in different styles, such as Finance, finance, and FIN-01. Reports break when a value does not match the approved list exactly.
The FinOps lead wants resource creation to keep working in every account, and wants only approved values accepted for CostCenter on resources where the tag can be enforced. Checking should cover all accounts from one place.
Which solution meets these requirements?
Choose one answer.
AA. Attach an SCP to every account that denies creating resources without a CostCenter tag. Let teams use any value they want, since the SCP checks only that the key is present.
BB. Run a nightly Lambda function that scans every account and rewrites each CostCenter value to the approved spelling. Teams will see their tags corrected by the next morning, and the reports will match the list.
CC. Use an AWS Config rule that marks resources as noncompliant when the CostCenter tag is missing, and send alerts to the teams. Leave the existing values alone, since the rule checks presence rather than spelling.
DD. Create a tag policy in AWS Organizations with the approved CostCenter values, enforced on supported resource types, and attach it to the root so that every account is covered.
Show the answer and explanation
Answer: D
A. Wrong: An SCP that requires the key cannot check the approved values, so the spelling mismatches continue. It also blocks creation of untagged resources, which the FinOps lead wants to keep working.
B. Wrong: Rewriting tags after the fact means reports are wrong until the next run. The function also changes values that teams set on purpose, and it must be maintained across 35 accounts.
C. Wrong: A presence rule checks that the key exists, so it cannot flag values written in the wrong style. The FinOps lead needs the approved values checked, not only the key.
D. Right: Correct. A tag policy defines the exact key and approved values, and enforcement rejects non-approved values on supported resource types. Attaching it to the root applies the rule to all accounts without blocking resources created without the tag. Learn more: Tag policies in AWS Organizations (opens in a new tab)
Explanation
Tag policies in AWS Organizations define the allowed keys and values, and enforcement rejects values outside the list for supported resources. Attaching the policy at the root covers every account from one place. Presence checks, SCPs that require the key, and after-the-fact rewrites each miss part of the requirement.
Want more on Tagging strategy and tag policies? The 5 full-length practice sets have 5 more Tagging strategy and tag policies questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →