Tag Policies vs required-tags rule

While Tag Policies in AWS Organizations and the required-tags rule in AWS Config serve similar purposes in managing resource tagging, they have distinct differences and use cases.

Tag Policies in AWS Organizations are designed to help standardize tags across resources in multiple accounts within an organization. They allow you to define a tagging schema that can be applied organization-wide or to specific Organizational Units (OUs). Tag policies can specify acceptable tag keys and values, and can be used to report on compliance across the organization. They are particularly useful for large enterprises that need to enforce consistent tagging across many accounts.

Key features of Tag Policies include:

1. They can be applied at the organization, OU, or account level.
2. They can define acceptable tag keys and values.
3. They can be used to report on compliance across the entire organization.
4. They don't prevent the creation of resources with non-compliant tags, but they do report on non-compliance.

The required-tags rule in AWS Config, on the other hand, is more focused on individual account compliance. It checks if specified AWS resources within a single account have the required tags with expected values. This rule is part of AWS Config's compliance checking capabilities.

Key features of the required-tags rule include:

1. It operates at the individual account level.
2. It can check up to six tags at a time.
3. It can be used to find non-compliant resources within an account.
4. It supports automated remediation through AWS Systems Manager Automation.

In terms of when to use each:

Use Tag Policies when:

• You need to standardize tagging across multiple accounts in an organization.
• You want to create a consistent tagging strategy across your entire AWS environment.
• You need to report on tag compliance across the organization.

Use the required-tags rule when:

• You're focusing on compliance within a single account.
• You want to automatically detect resources that don't meet your tagging requirements.
• You need to integrate tag compliance with other AWS Config rules and remediation actions.

In many cases, organizations might use both: Tag Policies to set the overall tagging strategy across the organization, and the required-tags rule to enforce and monitor compliance at the individual account level.
Sources
Tag policies - AWS Organizations
AWS Organizations – Tag policies - Best Practices for Tagging AWS Resources
required-tags - AWS Config
AWS Organizations tag policies - Tagging AWS Resources and Tag Editor