An organization uses AWS Organizations to manage accounts and deploys all infrastructure with AWS CloudFormation. The finance team needs chargeback reporting and asked business units to tag resources with a predefined list of project values. When finance filtered the AWS Cost and Usage Report by project, they found noncompliant project tag values. The company wants to enforce the allowed project tag values for new resources with the least effort. What should you do?

The correct solution uses an AWS Organizations tag policy to define allowed project tag values centrally in the management account, ensuring consistency across all accounts. The Service Control Policy (SCP) then enforces the use of a project tag during cloudformation:CreateStack operations, preventing resource creation if the tag is missing. Attaching the SCP to each OU applies this enforcement broadly with minimal administrative overhead. The first incorrect option suggests creating tag policies in each OU, which is less efficient than a single policy in the management account. The second incorrect option proposes an IAM policy attached to each user, which is difficult to manage at scale and doesn't prevent root user actions or actions from roles. The third incorrect option, using AWS Service Catalog, is a valid approach for managing CloudFormation stacks but is not the "least effort" solution for enforcing tag compliance on all new resources created via CloudFormation, as it requires all users to provision through Service Catalog.