SCP Tag Enforcement for S3 Bucket Creation and other AWS Services

Hello.

For SageMaker, DynamoDB, and SNS, the ABAC column in the following document is marked as "YES", so I think it is possible to control it using tags.
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html

Other resources are "Partial" so some may not be available.

Adding onto Riku's answer, S3 and SQS does not support enforcement of tags on creation of standard buckets using SCP. You will need to use a reactive tagging approach. Take a look at this blog post for a solution:

https://aws.amazon.com/blogs/storage/enforcing-organization-wide-amazon-s3-bucket-tagging-policies/

SCPs can enforce tag compliance only if the AWS API action supports resource-level tagging conditions such as:

• aws:ResourceTag/${TagKey}
• aws:TagKeys
• aws:RequestTag/${TagKey}

If the service action does not support these condition keys, then tag-based enforcement using SCPs will not work.

The action dynamodb:CreateTable supports:

• aws:RequestTag/${TagKey}
• aws:TagKeys
• aws:ResourceTag/${TagKey} (for updates)

Therefore, you can write an SCP like:

{
  "Effect": "Deny",
  "Action": "dynamodb:CreateTable",
  "Condition": {
    "Null": {
      "aws:RequestTag/Environment": "true"
    }
  },
  "Resource": "*"
}

This works because DynamoDB explicitly supports tag-based conditions for table creation. S3:CreateBucket does not support:

• aws:ResourceTag/${TagKey}
• aws:RequestTag/${TagKey}
• aws:TagKeys

Therefore, if you write an SCP like:

{
  "Effect": "Deny",
  "Action": "s3:CreateBucket",
  "Condition": {
    "Null": {
      "aws:RequestTag/Environment": "true"
    }
  },
  "Resource": "*"
}

It will always evaluate to true (because S3 never passes request tags). The condition always fails. Result: All S3 bucket creation gets denied, no matter what.

You can find the complete list of actions and supported condition here

https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazondynamodb.html