Scp Tag enforcement is not working on Ec2.

I have created an SCP to deny ec2 resource creation if there is no tag. The instance is only get created if it has an environment tag key mentioned in it.

Here is my policy :

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Scp1",
      "Effect": "Deny",
      "Action": [
        "ec2:CreateTags",
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:RequestTag/environment": "true"
        }
      }
    }
  ]
}

トピック

計算する管理とガバナンス

タグ

Amazon EC2 AWS Organizations

言語

English

Shubham

質問済み 2年前1021ビュー

2回答

新しい順
投票が多い順
コメントが多い順

これらの回答は役に立ちましたか？コミュニティがあなたの知識を活用できるように、正解に賛成票を投じてください。

Yes I am trying to achieve this thing but I want to achieve this by using AWS SCP. All post which I have seen they all have same json file as mine. But while implementation it is not working.

Shubham

回答済み 2年前

RichardFan
2年前
So what condition type you are using?

ForAllValues:StringEquals? Or StringNotLike?
Shubham
2年前
I have used Both but no luck.
RichardFan
2年前
Can you also post the policy you use with StringNotLike to see if there is any other issue?

Shubham

2年前

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Scp1",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:RequestTag/environment": "true"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Scp1",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "ForAllValues:StringNotLike": {
          "aws:RequestTag/environment": "true"
        }
      }
    }
  ]
}

RichardFan
2年前
Your policy with

"ForAllValues:StringNotLike": { "aws:RequestTag/environment": "true" }

means all your new EC2 instances need to have a tag environment and the tag value must be exactly true

Is this what you expect and what you get?

I guess you are trying to achieve something like this: https://aws.amazon.com/premiumsupport/knowledge-center/iam-policy-tags-deny/ (Sid: AllowRunInstancesWithRestrictions1)

Your policy can be modified as follow:

{
    "Effect": "Deny",
    "Action": [
        "ec2: CreateTags",
        "ec2: RunInstances"
    ],
    "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
    ],
    "Condition": {
        "StringNotLike": {
            "aws:RequestTag/cost_center": "?*"
        }
    }
}

RichardFan

回答済み 2年前

Scp Tag enforcement is not working on Ec2.

関連するコンテンツ