Option A is incorrect because S3 event notifications do not support s3.ObjectTagging:Put events. S3

event notifications only support events related to object creation, deletion, replication, and restore.

Moreover, enabling bucket versioning on the S3 bucket is not relevant to the tagging requirements,

as it only keeps multiple versions of objects in the bucket.

Option B is incorrect because enabling server access logging on the S3 bucket does not help with

tagging the resources. Server access logging only records requests for access to the bucket or its

objects. It does not capture the user ID or the cost center ID of the resources. Furthermore, creating

an S3 event notification on the S3 bucket for s3.ObjectTagging:Put events is not possible, as

explained in option A.

Option C is incorrect because creating a recurring hourly Amazon EventBridge scheduled rule that

invokes the Lambda function is not efficient or timely. The Lambda function would have to read the

logs from the S3 bucket every hour and tag the resources accordingly, which could incur unnecessary

costs and delays. A better solution would be to trigger the Lambda function as soon as a resource is

created, rather than waiting for an hourly schedule.

Option D is correct because creating an Amazon EventBridge rule that uses Amazon EC2 as the event

source and matches events delivered by CloudTrail is a valid way to tag the resources. CloudTrail

records all API calls made to AWS services, including EC2, and delivers them as events to

EventBridge. The EventBridge rule can filter the events based on the user ID and the resource type,

and then target the Lambda function to tag the resources with the cost center ID. This solution meets

the tagging requirements in a timely and efficient manner.

S3 event notifications

Server access logging

Amazon EventBridge rules

AWS CloudTrail