AWS Organizations tag policies are the designated service for centrally governing and enforcing tagging standards across multiple accounts. By defining a tag policy at the organization's root or an organizational unit (OU), an administrator can mandate specific tags, define allowed values, and prevent non-compliant resource creation or tagging changes. This declarative approach is the most efficient method for ensuring consistency. After establishing the tags, they must be activated as cost allocation tags in the AWS Billing and Cost Management console to be included in cost reports, which directly addresses the cost tracking requirement. This solution provides centralized enforcement with minimal operational effort.

B: This is a reactive, custom-built solution. It requires developing, deploying, and maintaining a Lambda function and associated event rules, which incurs significantly more operational overhead than using a managed policy service.

C: AWS Config is primarily a detective control for evaluating compliance, not a preventative enforcement mechanism. AWS Budgets is used for monitoring costs and usage, not for applying or enforcing tags.

D: AWS Service Catalog only controls resources provisioned through it, not all resources. AWS Trusted Advisor provides recommendations and detects missing tags but does not enforce tagging policies.

1. AWS Organizations User Guide: "Tag policies are a type of policy that can help you standardize tags on resources in your organization's accounts... You can use tag policies to maintain consistent tags

including the preferred case for tag keys and tag values." (See section: Tag policies).

2. AWS Billing and Cost Management User Guide: "After you activate tags

AWS uses the tags to organize your resource costs on your cost allocation report... AWS provides two types of cost allocation tags: AWS-generated tags and user-defined tags. You must activate both types of tags separately in the Billing and Cost Management console before they can appear in your cost allocation report." (See section: Using cost allocation tags).

3. AWS Organizations User Guide: "When you attach a tag policy to an organization entity (root

OU

or account)

any specified noncompliant tagging operations on specified resource types are prevented." (See section: Understanding tag policy inheritance and enforcement). This confirms the enforcement capability

which is superior to the detective nature of other options.