SAP-C02 Practice Question 11: Tag Governance Cost Allocation
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 2 · question 1 of 10
A company runs 90 AWS accounts in one organization in AWS Organizations with all features enabled. Finance wants monthly chargeback by cost centre, but the first attempt failed: teams tag resources with CostCenter, costcenter, and cost-center, and some use values that are not real cost centre codes. Even resources that are tagged correctly never show up as a grouping dimension in AWS Cost Explorer.
The platform team must standardize one tag key with a fixed case and a fixed list of allowed values across every account, block tagging requests that use a noncompliant value on the resource types that matter most, see compliance for the whole organization from one place, and make the tag usable in Cost Explorer and the cost allocation report. Which approach meets all of these requirements?
Show answer and explanation
Answer:
Two separate problems are hiding in the stem, and option D is the only one that fixes both. Tag policies are the AWS Organizations policy type for standardizing tags: a policy defines the tag key, its case treatment, and its allowed values. When enforcement is turned on for specific resource types, noncompliant tagging requests on those types fail. Signed in to the management account, you can view tag compliance for every account in the organization. The second problem is why correct tags never appear in Cost Explorer. User-defined tags have to be activated as cost allocation tags before they show up in Cost Explorer or the cost allocation report, and in an organization only the management account can reach the cost allocation tags manager. Tags that nobody activated stay invisible to billing no matter how clean they are.
Note what tag policies do not do: untagged resources are not evaluated, so a tag policy does not force every resource to carry the tag. The stem asks for a standard key and valid values, not mandatory tagging, so this gap doesn't matter here.
Option A is detective only. Config rules report missing tags after the fact and block nothing. Member accounts also cannot activate cost allocation tags. That console is only available in the management account (or a standalone account), so the Cost Explorer problem stays unsolved.
Option B addresses the wrong control. An SCP that requires the tag on create can force a tag to be present, but it can't standardize case or values across services without a large, fragile condition list. It also breaks every service action whose create call can't carry tags. Reporting by account instead of by tag abandons the cost-centre chargeback that was asked for.
Option C is a one-off manual cleanup with no preventive control, so the variants reappear the next week. Budgets alert on spend but depend on the same activated cost allocation tag to filter by CostCenter, which this option never activates.
References: Tag policies; Organizing and tracking costs using AWS cost allocation tags