Which actions should a solutions architect take to resolve the problem and prevent it from happening in the future?
(Choose three.)
Create an AWS Config rule in each account to find resources with missing tags.
Create an SCP in the organization with a deny action for ec2:Runlnstances if the Project tag is missing.
Use Amazon Inspector in the organization to find resources with missing tags.
Create an IAM policy in each account with a deny action for ec2:Runlnstances if the Project tag is missing.
Create an AWS Config aggregator for the organization to collect a list of EC2 instances with the missing Project tag.
Use AWS Security Hub to aggregate a list of EC2 instances with the missing Project tag.
Explanations:
Creating an AWS Config rule in each account allows for continuous monitoring of resources for compliance with tagging policies. This rule can specifically check for resources lacking the required Project tag, enabling identification of non-compliant resources promptly.
Implementing a Service Control Policy (SCP) at the organizational level with a deny action forec2:RunInstancesif the Project tag is missing effectively prevents the launching of new EC2 instances without the necessary tags. This enforces tagging compliance before resources can be created.
Amazon Inspector is primarily used for security assessments, vulnerability management, and compliance checks rather than resource tagging. It does not provide functionality for finding resources with missing tags, making this option unsuitable for the tagging issue.
While creating an IAM policy with a deny action forec2:RunInstancescould theoretically prevent the launching of EC2 instances without the Project tag, IAM policies are not designed for this purpose across multiple accounts and could create management overhead. SCPs are a more effective solution for organizational-wide policies.
An AWS Config aggregator can be set up to collect compliance data from all accounts in the organization, including information about EC2 instances lacking the Project tag. This allows for centralized visibility and reporting of tagging compliance across multiple accounts.
AWS Security Hub is focused on security findings and compliance status rather than resource tagging. It does not specifically aggregate data about missing tags for resources like EC2 instances, making it an inappropriate choice for addressing the tagging issue.