DataWorks mandates that every new EC2 instance and every new RDS DB instance must include CostCenter and DataOwner tags at creation time across all accounts in the organization. The control must be preventive. What is the BEST way to meet this requirement?

The correct answer is to attach a Service Control Policy (SCP) at the organization root. SCPs are preventive controls that apply to all accounts within an AWS Organization, ensuring compliance at the point of resource creation. By denying ec2:RunInstances and rds:CreateDBInstance actions if the aws:RequestTag/TagKeys condition does not include CostCenter and DataOwner, you enforce the tagging requirement preventively across the entire organization. AWS Organizations Tag Policies are for auditing and reporting on tag compliance, not for preventing resource creation. AWS Config rules are detective controls that identify non-compliant resources after they are created and can auto-remediate, but this is not a preventive measure. IAM permission boundaries define the maximum permissions an IAM entity can have but do not directly prevent resource creation based on missing tags; an SCP is more effective for this organization-wide preventive control.