What should the SysOps administrator do to tag the “No Tagkey” resources?
Add the accounts to AWS Organizations. Use a service control policy (SCP) to tag all the untagged resources.
Use an AWS Config rule to find the untagged resources. Set the remediation action to terminate the resources.
Use Cost Explorer to find and tag all the untagged resources.
Use Tag Editor to find and tag all the untagged resources.
Explanations:
Service control policies (SCPs) in AWS Organizations manage access and permissions, not resource tagging. SCPs cannot automatically tag resources or enforce tagging.
AWS Config rules can detect untagged resources, but setting a remediation action to terminate resources is an extreme measure and would not effectively help with simply tagging untagged resources.
Cost Explorer can report on cost and usage, but it does not have the capability to tag untagged resources directly. It helps identify costs but does not handle tagging operations.
Tag Editor is the correct tool to find and tag untagged resources across accounts. It allows administrators to search for untagged resources and apply tags to them, making it the appropriate solution in this scenario.
I sort that the answer is:
Use Tag Editor to find and tag all the untagged resources.