What action can the Administrator take to implement this for real-time enforcement?
Use the AWS Tag Editor to manually search for untagged resources and then tag them properly in the editor.
Set up AWS Service Catalog with the TagOptions Library rule that enforces a tagging taxonomy proactively when instances and volumes are launched.
In a PowerShell or shell script, check for untagged items by using the resource tagging GetResources API action, and then manually tag the reported items.
Launch items by using the AWS API. Use the TagResources API action to apply the required tags when the instances and volumes are launched.
Explanations:
The AWS Tag Editor is a manual tool that allows administrators to find and tag resources after they have been created. This does not provide real-time enforcement of tagging during the resource creation process.
AWS Service Catalog with the TagOptions Library enables the enforcement of tagging policies at the time of resource creation. It allows administrators to define a tagging taxonomy that must be applied when instances and volumes are launched, thus ensuring real-time enforcement.
Using a PowerShell or shell script to check for untagged resources is a reactive approach. This method requires manual intervention to tag the items, and it does not provide real-time enforcement at the time of resource creation.
While using the TagResources API action is a valid way to tag resources, it is not a proactive enforcement mechanism during resource creation. This option suggests applying tags after launching the resources, which does not ensure that all resources will be tagged upon creation.