Scp Tag enforcement is not working on Ec2.
I have created an SCP to deny ec2 resource creation if there is no tag. The instance is only get created if it has an environment tag key mentioned in it.
Here is my policy :
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Scp1",
"Effect": "Deny",
"Action": [
"ec2:CreateTags",
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"ForAllValues:StringEquals": {
"aws:RequestTag/environment": "true"
}
}
}
]
}
Yes I am trying to achieve this thing but I want to achieve this by using AWS SCP. All post which I have seen they all have same json file as mine. But while implementation it is not working.
I have used Both but no luck.
Can you also post the policy you use with StringNotLike to see if there is any other issue?
{ "Version": "2012-10-17", "Statement": [ { "Sid": "Scp1", "Effect": "Deny", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "ForAllValues:StringEquals": { "aws:RequestTag/environment": "true" } } } ] } { "Version": "2012-10-17", "Statement": [ { "Sid": "Scp1", "Effect": "Deny", "Action": [ "ec2:RunInstances" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ], "Condition": { "ForAllValues:StringNotLike": { "aws:RequestTag/environment": "true" } } } ] }Your policy with
"ForAllValues:StringNotLike": { "aws:RequestTag/environment": "true" }means all your new EC2 instances need to have a tag
environmentand the tag value must be exactlytrueIs this what you expect and what you get?
I guess you are trying to achieve something like this: https://aws.amazon.com/premiumsupport/knowledge-center/iam-policy-tags-deny/ (Sid: AllowRunInstancesWithRestrictions1)
Your policy can be modified as follow:
{
"Effect": "Deny",
"Action": [
"ec2: CreateTags",
"ec2: RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringNotLike": {
"aws:RequestTag/cost_center": "?*"
}
}
}
Relevant questions
Unable to create Tag to restrict resource deployment
asked 6 months agoAlarm for resource created without tag
asked 3 months agoUnable to deny snapshot creation based on tags
Accepted Answerasked 2 years agoAssign Multiple Values to a Single key tag In AWS
asked 3 months agoThe EBS snapshot policy does not create a tag from the instance
asked 4 months agoTag enforcement while creating a new resource
Accepted Answerasked 2 years agoEnforcing Tag Policies on existing instances
Accepted Answerasked 2 years agoTag Policies: Account shows as compliant despite non-compliant resources
Accepted Answerasked 3 years agoScp Tag enforcement is not working on Ec2.
asked 21 days agoA new EC2 instance is created after termination of the only instance
Accepted Answerasked 2 years ago
So what condition type you are using?
ForAllValues:StringEquals? Or StringNotLike?