AWS organizations documentation change
Summary
Added Example 4 demonstrating required tag enforcement for compliance, updated topics list, and clarified enforcement mechanics for tag policies. Includes IaC integration guidance for CloudFormation/Terraform/Pulumi.
Security assessment
The change adds documentation about enforcing mandatory tags (CostCenter, Environment, Owner) to improve compliance and resource governance. While this enhances security posture through better resource tracking, there's no evidence of addressing a specific vulnerability. The documentation explains how to configure preventive controls but doesn't reference any security incident or weakness being patched.
Diff
diff --git a/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.md b/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.md index 6bc933173..e3b072ae4 100644 --- a//organizations/latest/userguide/orgs_manage_policies_example-tag-policies.md +++ b//organizations/latest/userguide/orgs_manage_policies_example-tag-policies.md @@ -5 +5 @@ -Tag policy syntaxTag policy examplesExample 1: Define organization-wide tag key caseExample 2: Prevent use of a tag keyExample 3: Specify a tag policy for all supported resource types of a specific AWS service +Tag policy syntaxTag policy examplesExample 1: Define organization-wide tag key caseExample 2: Prevent use of a tag keyExample 3: Specify a tag policy for all supported resource types of a specific AWS serviceExample 4: Enforce required tag keys for compliance @@ -10,0 +11,17 @@ This page describes tag policy syntax and provides examples. +###### Topics + + * Tag policy syntax + + * Tag policy examples + + * Example 1: Define organization-wide tag key case + + * Example 2: Prevent use of a tag key + + * Example 3: Specify a tag policy for all supported resource types of a specific AWS service + + * Example 4: Enforce required tag keys for compliance + + + + @@ -61 +78 @@ In this example, acceptable values for the `CostCenter` tag key are `100`, `200` -The example tag policy specifies that the `CostCenter` tag passed on all AWS Secrets Manager resources must be compliant with this policy. +The example tag policy specifies that the `CostCenter` tag applied to all AWS Secrets Manager resources must be compliant with this policy. @@ -73 +90 @@ You should only change this option from the default if you are experienced with - * You can use the `ALL_SUPPORTED` wildcard in the `enforced_for` field with some services to enable enforcement for all resources for that service. For a list of services and resource types that support `enforced_for`, see [Services and resource types that support enforcement](./orgs_manage_policies_supported-resources-enforcement.html). + * You can use the `ALL_SUPPORTED` wildcard in the `enforced_for` field with some services to enable enforcement for all supported resources for that service. For a list of services and resource types that support `enforced_for`, see [Services and resource types that support enforcement](./orgs_manage_policies_supported-resources-enforcement.html). @@ -252,0 +270,93 @@ This policy uses the `ALL_SUPPORTED` wildcard to specify that all Amazon EC2 ins +## Example 4: Enforce required tag keys for compliance + +This example demonstrates how to define a tag policy that requires all resources to include mandatory compliance tags. Organizations commonly use this pattern to ensure proper cost allocation, ownership tracking, and environment identification. + + + { + "tags": { + "CostCenter": { + "report_required_tag_for": { + "@@assign": [ + "ec2:instance", + "s3:bucket", + "rds:db", + "lambda:function" + ] + }, + "tag_key": { + "@@assign": "CostCenter" + } + }, + "Environment": { + "report_required_tag_for": { + "@@assign": [ + "ec2:ALL_SUPPORTED", + "rds:ALL_SUPPORTED", + "s3:ALL_SUPPORTED" + ] + }, + "tag_key": { + "@@assign": "Environment" + }, + "tag_value": { + "@@assign": [ + "Production", + "Staging", + "Development", + "Test" + ] + } + }, + "Owner": { + "report_required_tag_for": { + "@@assign": [ + "ec2:ALL_SUPPORTED" + ] + }, + "tag_key": { + "@@assign": "Owner" + } + } + } + } + +When you apply this policy and configure your IaC tool with tag policy enforcement: + + * CostCenter: Required for EC2 instances, S3 buckets, RDS databases, and Lambda functions + + * Environment: Required for all EC2, RDS, and S3 resources, with allowed values restricted to Production, Staging, Development, or Test + + * Owner: Required for all EC2 resources in your organization + + + + +Example infrastructure code that complies with this policy: + + + EC2Instance: + Type: AWS::EC2::Instance + Properties: + ImageId: ami-0c02fb55956c7d316 + InstanceType: t2.micro + Tags: + - Key: CostCenter + Value: CC-12345 + - Key: Environment + Value: Test + - Key: Owner + Value: [email protected] + +If you attempt to create a resource without the required tags, your IaC deployment will fail or generate a warning during the planning phase, depending on your configuration. When configured in fail mode, the deployment is blocked before any resources are created. When configured in warn mode, the deployment proceeds but alerts your team to the missing tags. The validation error message identifies exactly which required tags are missing and which resources need them. + +For specific configuration instructions for your IaC tool: + + * **CloudFormation** : See [Enforce with CloudFormation](./enforce-required-tag-keys-iac.html#enforce-with-cloudformation) to activate the tagging compliance hook + + * **Terraform** : See [Enforce with Terraform](./enforce-required-tag-keys-iac.html#enforce-with-terraform) to enable tag policy validation in the AWS Provider + + * **Pulumi** : See [Enforce with Pulumi](./enforce-required-tag-keys-iac.html#enforce-with-pulumi) to enable the Tag Policy Reporting policy pack + + + + @@ -259 +369 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Services and resource types that support enforcement +Enforce "Required tag key" with IaC @@ -261 +371 @@ Services and resource types that support enforcement -Supported Regions +Identify and remediate tagging inconsistencies