Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 294 discussion

The key to the answer is in the first sentence of A and B. You can create a Tag Policy in the Management Account not OU since the OU is not an "Account" but a target where a policy is applied. Tag Policy is not the same as an SCP. See: https://aws.amazon.com/blogs/mt/implement-aws-resource-tagging-strategy-using-aws-tag-policies-and-service-control-policies-scps/

A is correct BUT I did NOT like the last line in option A. It says "Attach the SCP to each OU". Why should you attach SCP to each OU. Can't you just attach to RootOU so it gets inherited to child OUs

Ok this is strange if you do not use this stuff regularly as AWS uses "tag policy" for several different configuration services. You can apply a tag policy on the management account through AWS Organization. If you do it all child OUs will inherit the tag policy. If you do the same "tag policy" on the management account using AWS Resource Groups Tag Editor it will not be inherited. B was a very seductive answer, even chatGPT made a mistake here by defining this answer as good in first occurence. But considering we use AWS Organization to manage everything, it's clearly an AWS Organization Tag Policy which is used here. So a tag policy applied on the management account will be inherited by the child OUs. Answer is A. AWS terminology can be really bad.

Correct A.

A. tag policy create in management account

A) in management account for tag policy and SCP , Sounds Good B) for each account ? more overhead C ) IAM for account in cloudformation ? is incorrect in this case D) AWS Service Catalog ? why ? incorrect

A - Correct. You create an SCP with allowed tags in the root OU and then attach the SCP to all OUs.

AAAAAAAAAAAAA

Correct Answer is A

A) Is correct in the master account of all organization use SCP is less overhead than B B ) is more overhead than A because in each OU create SCP C ) IAM in all account is more overhead D) is valid but not restrict other options o create with CLI or console the rest service without tags Then A is correct

olabiba.ai says 'A'

Correct Answer is A

What not use SCP?