Enforce tagging at the time of resource creation

Question

I want to enforce the tagging for the management of resources. So I am doing this by using aws organizations service control policies(SCP). But I am not able to enforce it and still able to create resources without tagging it. I have used the policy which is given in the documentation.
Can you please give me snippet of SCP which is working ?
I have tried following policies.

{
  "Version": "2012-10-17",
  "Statement": [
1)  
  {
      "Sid": "SCP1",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/Env": "true"
        }
      }
2)
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyRunInstanceWithNoProjectTag",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "StringLike": {
          "aws:RequestTag/Env": "true"
        }
      }
    }
    }
3)
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyRunInstanceWithNoProjectTag",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/Env": "true"
        }
      }
    },
4)
    {
      "Sid": "DenyRunInstanceWithNoCostCenterTag",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/": "true"
        }
      }
    }
  ]
}

rePost-User-6689520 · Answer

it took my a while but i have this working:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyLambda",
      "Effect": "Deny",
      "Action": [
        "lambda:CreateFunction"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/team": "true"
        }
      }
    }
  ]
}

make sure it is attached to the right role as well!

And logout and back in to make sure the new policy is enabled

Didier Durand · Answer

Hi, you may want to follow this detailled blog post: https://aws.amazon.com/blogs/mt/implement-aws-resource-tagging-strategy-using-aws-tag-policies-and-service-control-policies-scps/

It combines SCPs and tag policies.  Having proper tag policies in place is key as per post:

```
When a tag policy is applied to your AWS account, users are unable 
to create resources using noncompliant tags.

You can enforce specific tag policies by choosing the option ‘prevent 
non-compliant operations for this tag’, and selecting the resource types 
that supports tag policy enforcement.
```

Please, also have a look at https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies-best-practices.html

```
Resources that have never had tags attached to them don't show as noncompliant 
in reports. Account administrators can still create untagged resources. In some cases, 
you can use a service control policy (SCP) to set guardrails around resource creation 
requests. For an example SCP, see Require a tag on specified created resources. To 
learn whether an AWS service supports controlling access using tags, see AWS Services 
that Work with IAM in the IAM User Guide. Look for the services that have Yes in the 
Authorization based on tags column. Choose the name of the service to view the 
authorization and access control documentation for that service.
```

So, you will have to check this table to see if the services that you use supports controlling access using tags.

Best,

Didier

Enforce tagging at the time of resource creation

Add your answer

Relevant content