Tag Enforcement for EC2 - AWS

Question

I wanted to enforce tags for EC2. Means, without certain tags, it shouldn't allow to launch EC2 instance. I have a solution with IAM Policy, but I don't want this to be with IAM Policy.

Looking for some other way to enforce tags. Please advice.

Thanks

user_13460933 · Answer

I your account is part of an AWS organisation then you're in luck. AWS released a feature called tag-policies that specifically forces EC2 instances in an organisational unit to require certain tags.

However if your account is standalone (not part of an AWS organisation) then IAM will be the primary tool for controlling user access, so if a permission is set here then it will always be allowed.

There is another options to remove these instances if you are in a stand alone account using AWS Config.

AWS Config has a managed rule of required-tags. Assuming a required rule is not set then a Lambda can be invoked to terminate the instance in question.

user_13077125 · Answer

Go to Polices in AWS Organizations and select Tag policies. be sure to enable it if it isn't enabled prior. then create a policy like this. you can use the given json editor for this.

{ 
  "tags": { 
    "User": { 
      "tag_key": { 
        "@@assign": "User" 
      }, 
      "enforced_for": { 
        "@@assign": [ 
          "ec2:instance" 
        ] 
      } 
    }, 
    "Duration": { 
      "tag_key": { 
        "@@assign": "Duration" 
      }, 
      "enforced_for": { 
        "@@assign": [ 
          "ec2:instance" 
        ] 
      } 
    } 
  } 
}

In here, I have created a tag policy for User tag and Duration Tag. Once the tag policy is created, make sure to attach it to the target OU/Account.

After this, go to Policies again and select Service control policies (SCPs) and if it isn't available, make sure to enable it. In there, create a new SCPs policy and add the following policy.

{ 
  "Version": "2012-10-17", 
  "Statement": [ 
    { 
      "Sid": "DenyEC2CreationSCP1", 
      "Effect": "Deny", 
      "Action": [ 
        "ec2:RunInstances" 
      ], 
      "Resource": [ 
        "arn:aws:ec2:*:*:instance/*", 
        "arn:aws:ec2:*:*:volume/*" 
      ], 
      "Condition": { 
        "Null": { 
          "aws:RequestTag/User": "true" 
        } 
      } 
    }, 
    { 
      "Sid": "DenyEC2CreationSCP2", 
      "Effect": "Deny", 
      "Action": [ 
        "ec2:RunInstances" 
      ], 
      "Resource": [ 
        "arn:aws:ec2:*:*:instance/*", 
        "arn:aws:ec2:*:*:volume/*" 
      ], 
      "Condition": { 
        "Null": { 
          "aws:RequestTag/Duration": "true" 
        } 
      } 
    } 
  ]

In here I have created SCP to enforce previous tag policy. Once the SCPs are created, make sure that you attach it to the target OU/Account.

Tag Enforcement for EC2 - AWS

2 Answers