How to show meaningful message with Tag Policy

Question

When I [added Tag Policy](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies-create.html) to my resources I can't get the show a meaningful error message to the users that are violating this policy.

They get a message with encoded authorization failure message that looks like this:
```
Instance launch failed
You are not authorized to perform this operation. Encoded authorization failure message: P1LEqsQ1orBoHehDtgplDLEXWiLanDeBQnxbP1nuXL6lPD4dPu9ziQleETlPnaHFjAVKJmdn4ZGl6xdTiD2LQILFWnqcHDAvZprs4aGvJ3WTS_igTs0Mxewe6ujcyUH1LcG7XhzgqUNEKEQGXvgNIQRpexi5HS0ggON_sJe5HRDFPjR8LciUwS1cJgQ1EnPagzU-Pm_ugNxuTBtp6K1SMLBM06JylxliLDI4IOuEx-PCirEGqPQ5H90nOVWA23Q6ah-UJ5WOmWnbC9lwvVjneDZ3VjoNJa3swU5zxbi-TTAHdMxAEY1RxpQ4F8T5OP-N-1qgXzuvWJArmMkIQ-1FDt28nM_76FMH8xateCHC1Ip9iJT0Jhwfjk9SSfRur37a3H1xILZfd-VwvlL2JJJZxR_YBb7lMiIvwutFRnBMCzNsAklA9cvxK03HQZmhzcov568iysIb8-WQwVrROJHtdKmfxZ5fX5RX58nfolurWQJBAnrlYCPiXZx1kqhFAm4p7pdXh5RyaJ_3tGYiFpeqnNUIHtVmhkEQdzsPmRomQh-GwYD6g3x3hRL2hh7eAjtH8ZfgIf67ofvOH19ErcHYHRLJjelwyrGudiFGMgKerqkscj8d0n2y4R8ddp8eNG6XkUARPEAAUF_l3z3MxMM6N6Ka5iV--8VCr1ikIkZLj-BNy9-EBWk7G64bJvWMAjyczTv1agRae_kGi_r773BWhKEaqhT82kCxwyfxmvy6WINhYiboPQ5cW-r_4EsJ61lgf9_HYT2kzClZcv_-8XAapHaugmeyZJSBxy4eUYfeGa4t7mwRzJhp0-Rtc19QeHMkzIIm1SIRSABijLsYO0950DbsGkosf1YufifYolTNU9swq5mcsVoZGA
Launch log
Initializing requests
Succeeded
Creating security groups
Succeeded
Creating security group rules
Succeeded
Launch initiation
Failed
```
I saw that there is an [API call in STS](https://docs.aws.amazon.com/cli/latest/reference/sts/decode-authorization-message.html) that can decode it, which I couldn't really make work myself, since I don't know in which account to run it in my Organization. Nevertheless, it is not usable for the users that get this in the console or CLI.

What configurations or permissions I should add to make the error messages more meaningful?

Answer

CloudTrail will have a record of this event, which in this case would specifically be 'RunInstances'. Within this event we will be presented with a record of the operation attempted, including the user/role, event source, and tag information that we could use to compare against the configured tag policy. Additionally, we have the ability to centralize our CloudTrail log files from multiple accounts in an AWS Organization, which could be helpful from a reporting perspective.

Depending on the persistence of this issue, you may consider developing a custom notification system on CloudTrail events matching your criteria that would alert you to failed RunInstances operations resulting from a lack of required tag values.

https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html

How to show meaningful message with Tag Policy

Relevant content