SAP-C02 Q236 · Multi-Account

Question

A company is designing an AWS Organizations structure. The company wants to standardize a process to apply tags across the entire organization. The company will require tags with specific values when a user creates a new resource. Each of the company's OUs will have unique tag values. Which solution will meet these requirements?

Accepted Answer

Answer A combines two complementary mechanisms perfectly:

**1. SCP to deny creation of resources without required tags:**
- SCPs act as permission guardrails. By using a **deny** policy, you ensure no resource can be created without the required tags, regardless of the user's IAM permissions.
- SCPs use deny-based logic most effectively. A deny SCP is explicit and cannot be overridden by any allow statement at the IAM level.

**2. Tag policy with specific values per OU:**
- Tag policies define the **allowed/required tag keys and acceptable values**. They standardize tagging conventions.
- Tag policies support inheritance and can define different allowed values for different OUs.

**3. Attach tag policies to the OUs (not the management account):**
- Each OU has unique tag values, so attach

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips