An organization in AWS Organizations (all-features enabled) must ensure every EC2 instance in the organization's accounts has the CostCenter tag key and that the tag value is an approved cost-center value. Some developers add arbitrary values to avoid notifications from a scanning script. Which approach enforces correct tag keys and approved values across the OU?

The correct answer effectively combines preventative and detective controls. An SCP prevents the creation of EC2 instances without the CostCenter tag key, ensuring the tag is always present. A tag policy then restricts the values for this CostCenter tag to a predefined list, preventing developers from using arbitrary values. Attaching both to the OU enforces these rules across all accounts within that OU. The scanning script acts as a detective control, identifying non-compliant resources (e.g., if a developer bypassed initial checks or if a resource was created before policies were fully in place) and automatically remediating them by setting a default approved value, ensuring continuous compliance. Incorrect options: The second option only prevents missing tag keys and relies solely on notifications for incorrect values, which doesn't enforce compliance. The third option uses an IAM permission boundary, which is applied to IAM principals, not directly to resources or resource creation, making it less effective for organization-wide enforcement of tag values. The fourth option uses a Lambda to add an empty tag, which doesn't enforce correct values, and relies on a tag policy that only restricts values, not the presence of the tag itself, allowing instances to be created without the tag.