Tagging policy at account level

0

I tried to define a tagging policy (for ec2 instance) at Org level and have attached to a child account. JSON looks something like below. I’m not able to see any tags after instance creation in the child account. However, if I try to manually add the tag for same key, it does evaluate as per the policy . Say - I can define a tag with key as ‘Function’ and value as ‘Devops’ , I’m not allowed add a tag with other value with the Function as key . Is this the expected behaviour, any leads ?

{
    "tags": {
        "Function": {
            "tag_key": {  
                "@@assign": "Function"  
            },  
            "tag_value": {  
                "@@assign": [  
                    "Devops",  
                    "DevOps"  
                ]  
            },  
            "enforced_for": {  
                "@@assign": [  
                    "ec2:elastic-ip",  
                    "ec2:instance",  
                    "ec2:volume"  
                ]  
            }  
        },  
        "Name": {  
            "tag_key": {  
                "@@assign": "Name"  
            },  
            "enforced_for": {  
                "@@assign": [  
                    "ec2:instance"  
                ]  
            }  
        },  
        "Instance Owner": {  
            "tag_key": {  
                "@@assign": "Instance Owner"  
            },  
            "tag_value": {  
                "@@assign": [  
                    "*example.com"
                ]
            },
            "enforced_for": {
                "@@assign": [
                    "ec2:instance"
                ]
            }
        }
    }
}
已提問 4 年前檢視次數 585 次
1 個回答
0
已接受的答案

This is the expected behaviour; Tag Policies only enforce values for tags which are present and do not enforce the presence of a tag: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies-enforcement.html

As alternatives you could specify in the IAM policy that the tag must be specified on creation of the resource, and/or you can use AWS Config to report compliance on tag presence or not.

profile pictureAWS
專家
James_S
已回答 4 年前
profile picture
專家
已審閱 23 天前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南