A large company has seen an unexpected spike in Amazon RDS and Amazon DynamoDB charges. The organization uses AWS Organizations with many development and production accounts. There is no enforced tagging strategy across accounts, though guidelines require infrastructure to be deployed with AWS CloudFormation and consistent tags. Management mandates that all existing and future DynamoDB tables and RDS instances include cost center and project ID values. Which approach should the solutions architect recommend to satisfy these requirements?

The correct approach addresses both existing and future resources efficiently. Tag Editor allows for bulk tagging of existing RDS and DynamoDB instances, which is crucial given the lack of an enforced tagging strategy. Creating cost allocation tags ensures these tags are included in billing reports for cost analysis. Implementing Service Control Policies (SCPs) at the AWS Organizations level is the most effective way to enforce tagging for new resources across all accounts, preventing their creation if required tags are missing. Incorrect options: Using Tag Editor alone doesn't enforce tagging for new resources. Cost allocation tag propagation doesn't automatically tag existing resources. An AWS Config rule for notification and a Lambda solution for tagging is reactive and complex. It doesn't prevent untagged resources from being created in the first place, and a Lambda solution for tagging across many accounts can be difficult to manage and scale. Modifying federated roles to prevent provisioning without tags is less comprehensive than SCPs, as it only applies to users accessing via those roles and doesn't cover programmatic access or other user types. Cost allocation tag propagation doesn't tag existing resources.