A company develops multiple projects across several AWS accounts under the same AWS Organization. Costs must be allocated to the owning project via a Project tag. The operations team found many EC2 instances missing the Project tag. Which actions should a solutions architect take to find current untagged instances and prevent future instances from being launched without the Project tag? (Choose three.)

To find current untagged instances, creating an AWS Config rule in each account is effective. This rule can evaluate resources for compliance with tagging policies. To centralize this information across multiple accounts, an AWS Config aggregator can then collect the compliance status, providing a consolidated view of untagged EC2 instances across the organization. To prevent future untagged instances, an AWS Organizations Service Control Policy (SCP) with a deny action for ec2:RunInstances if the Project tag is missing is the most effective solution. SCPs enforce policies across all accounts in an organization. Using Amazon Inspector is incorrect because it focuses on security vulnerabilities, not tagging compliance. An IAM policy in each account is less scalable and harder to manage than an SCP for an organization-wide policy. AWS Security Hub aggregates security findings, not general tagging compliance, making it unsuitable for this specific task.