Which approach most accurately enables auditable, region-aware governance across AWS accounts?

• A. Rely solely on IAM policies to enforce regional restrictions
• B. Use SSO to restrict regional access
• C. Use CloudFormation to deploy region-specific stacks
• D. Combine SCPs to restrict region creation with AWS Config rules and tagging governance to enforce auditing and regional controls

Answer: (D)

Auditable, region-aware governance across AWS accounts is achieved by placing guardrails at the organizational level and pairing them with continuous compliance checks and consistent tagging. Service Control Policies set permission guardrails across all accounts in an AWS Organization, restricting actions and the regions where resources can be created. This creates enforceable boundaries that apply everywhere, not just in a single account, which is essential for governance at scale.

Complementing those guardrails, AWS Config rules continuously evaluate resource configurations and regional usage, providing real-time compliance checks and an auditable trail of changes. This allows you to detect when resources are created in disallowed regions or when configurations drift from policy, and it creates evidence you can review during audits.

Tagging governance ensures resources carry consistent, required metadata. When combined with tagging policies and monitoring, tags support reporting, cost management, access controls, and enforcement actions, helping you verify compliance across regions and accounts.

Together, these elements address both enforcement and visibility: SCPs block unwanted regional actions, Config rules provide ongoing compliance monitoring and history, and tagging governance ensures auditable metadata. Relying only on IAM policies, SSO, or CloudFormation does not deliver the same broad, auditable, cross-account, region-aware governance.