Tagging policy at account level

0

I tried to define a tagging policy (for ec2 instance) at Org level and have attached to a child account. JSON looks something like below. I’m not able to see any tags after instance creation in the child account. However, if I try to manually add the tag for same key, it does evaluate as per the policy . Say - I can define a tag with key as ‘Function’ and value as ‘Devops’ , I’m not allowed add a tag with other value with the Function as key . Is this the expected behaviour, any leads ?

{
    "tags": {
        "Function": {
            "tag_key": {  
                "@@assign": "Function"  
            },  
            "tag_value": {  
                "@@assign": [  
                    "Devops",  
                    "DevOps"  
                ]  
            },  
            "enforced_for": {  
                "@@assign": [  
                    "ec2:elastic-ip",  
                    "ec2:instance",  
                    "ec2:volume"  
                ]  
            }  
        },  
        "Name": {  
            "tag_key": {  
                "@@assign": "Name"  
            },  
            "enforced_for": {  
                "@@assign": [  
                    "ec2:instance"  
                ]  
            }  
        },  
        "Instance Owner": {  
            "tag_key": {  
                "@@assign": "Instance Owner"  
            },  
            "tag_value": {  
                "@@assign": [  
                    "*example.com"
                ]
            },
            "enforced_for": {
                "@@assign": [
                    "ec2:instance"
                ]
            }
        }
    }
}
질문됨 4년 전585회 조회
1개 답변
0
수락된 답변

This is the expected behaviour; Tag Policies only enforce values for tags which are present and do not enforce the presence of a tag: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies-enforcement.html

As alternatives you could specify in the IAM policy that the tag must be specified on creation of the resource, and/or you can use AWS Config to report compliance on tag presence or not.

profile pictureAWS
전문가
James_S
답변함 4년 전
profile picture
전문가
검토됨 23일 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠