Enforcing AWS Resource Tagging with Tag Policies and SCPs

#Operational requirement

Untagged resources are a production liability, not a cosmetic gap. When cost reports show a chunk of spend sitting under “unassigned”, nobody can charge the right business unit, nobody can identify the owner of a stray EBS volume that has billed for months, and incident responders cannot filter CloudTrail or Security Hub findings by environment or owner during a live investigation. An auditor asking “show me every production database in scope for this control” will expose the gap immediately if tagging coverage is patchy.

Your job as the on-call engineer building this control: enforce four mandatory tags — Environment, Owner, CostCentre, Application — using an AWS Organizations tag policy plus a preventive Service Control Policy (SCP) that denies resource creation when tags are missing. AWS Config then covers anything the SCP cannot reach at creation time, such as CloudFormation drift or third-party tooling.

Retain as evidence: the tag policy JSON, the SCP JSON, a captured denied API call, and a Config compliance summary showing before/after remediation counts. Raise a change record before touching any OU — this is a preventive control and it can lock out legitimate deployments if misapplied.

#

Prerequisites

• AWS Organizations with all features enabled (not just consolidated billing)
• Management account or delegated administrator access
• Permissions: organizations:CreatePolicy, organizations:AttachPolicy, organizations:EnablePolicyType
• AWS Config already recording in the target member account

#

Step 1: Enable tag policies

1aws organizations enable-policy-type --root-id r-abcd --policy-type TAG_POLICY
2aws organizations list-roots --query 'Roots[0].PolicyTypes'

Remember: the tag policy reports non-compliance but does not block anything on its own. Enforcement comes from the SCP.

#

Step 3: Deploy the preventive SCP

1{"Version":"2012-10-17","Statement":[{"Sid":"DenyEC2WithoutMandatoryTags","Effect":"Deny","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:*:*:instance/*","Condition":{"Null":{"aws:RequestTag/Environment":"true","aws:RequestTag/Owner":"true","aws:RequestTag/CostCentre":"true","aws:RequestTag/Application":"true"}}}]}

Test in a non-production OU first, always. Attempt a deliberately incomplete launch:

aws ec2 run-instances --image-id ami-0abcdef1234567890 --instance-type t3.micro --tag-specifications 'ResourceType=instance,Tags=[{Key=Environment,Value=Development}]'

Expect an unauthorized operation denial. Confirm in CloudTrail that the denial traces to the SCP evaluation, not an unrelated IAM gap.

#

Step 4: Add detective coverage

aws configservice put-config-rule --config-rule '{"ConfigRuleName":"required-tags-check","Source":{"Owner":"AWS","SourceIdentifier":"REQUIRED_TAGS"},"InputParameters":"{"tag1Key":"Environment","tag2Key":"Owner","tag3Key":"CostCentre","tag4Key":"Application"}"}'

Give it roughly ten minutes to evaluate existing resources, then pull a baseline.

#Verification

#Failure Modes or Common Traps

Attaching the SCP to the root OU before testing locks out every account at once, including break-glass automation. Attach to one non-production OU first — no exceptions.

Auto Scaling groups break this constantly. If the launch template doesn’t propagate tags via TagSpecifications, every scale-out event gets denied and your application fails to recover during a capacity event. Test scaling activity explicitly before wider rollout.

A tag policy without the SCP is cosmetic. It reports drift; it stops nothing. Don’t let stakeholders assume otherwise.

Watch the Null condition carefully — a typo inverts the logic and either blocks everything or nothing.

#Rollback

If the SCP causes an unplanned outage, detach it immediately from the affected OU:

aws organizations detach-policy --policy-id p-9876543210 --target-id ou-abcd-11112222

Detachment takes effect within seconds. Leave the tag policy and Config rule in place — they are detective only and carry no operational risk. Document the rollback reason in the change record before re-attempting rollout.

#Operational Summary

This control converts tagging from a voluntary convention into an enforced gate: the SCP stops non-compliant creation at the API layer, the tag policy defines the standard, and Config catches anything that slips through via drift or unusual tooling paths. Roll it out OU by OU, verify against Auto Scaling and any automation pipelines first, and always keep a tested rollback command ready before touching a production OU.