Explanation

Correct Answer: D - Create a tag policy in Organizations that has a list of allowed application names.

Why this is correct:

1. AWS Organizations Tag Policies are specifically designed for this use case. They allow you to enforce tagging standards across all accounts in your organization.
2. Tag policies can define allowed values for specific tags (like application name), ensuring that only predefined values are used.
3. Enforcement mechanism: When a tag policy is violated, AWS will prevent the creation or modification of resources with non-compliant tags.
4. Organization-wide scope: Since the company has multiple accounts in AWS Organizations, tag policies can be applied at the organization level, ensuring consistent enforcement across all development team accounts.

Why other options are incorrect:

A. Create an IAM group that has a conditional Allow policy

• IAM policies can enforce tagging requirements, but this would need to be implemented in every account separately.
• This approach doesn't scale well across multiple accounts and requires manual management in each account.
• While technically possible with IAM policies, it's not the most efficient or scalable solution for an organization with multiple accounts.

B. Create a cross-account role that has a Deny policy

• A Deny policy for resources with the application name tag would actually prevent resources from being created with ANY application name tag, which is the opposite of what's needed.
• The requirement is to ALLOW creation only with APPROVED values, not to DENY all tagged resources.

C. Create a resource group in AWS Resource Groups

• Resource Groups are for organizing and viewing resources based on tags, not for enforcing tagging policies.
• Resource Groups don't prevent resource creation with non-compliant tags; they only help you find resources that already have specific tags.
• This is a monitoring/reporting tool, not an enforcement mechanism.

Key AWS Services for Tag Governance:

1. AWS Organizations Tag Policies - For enforcing tag standards across accounts
2. AWS Config Rules - For detecting non-compliant resources (but not preventing creation)
3. Service Control Policies (SCPs) - Can also enforce tagging but are more complex for this specific use case

Best Practice: For organization-wide tag enforcement with predefined allowed values, AWS Organizations Tag Policies are the recommended solution as they provide centralized management and enforcement across all member accounts.