3 ms·

You would think the most obvious feature of something called "tag policies" would be the ability to prevent creation of resources that violate the policy. Of co

You would think the most obvious feature of something called "tag policies" would be the ability to prevent creation of resources that violate the policy. Of course, due to the way the AWS APIs work, it can't do this. Such a disappointment in practice. I do agree it is still useful in the capacity you described.

acdha 6y ago
There are an increasing number of APIs where you can do this with IAM conditions but it’s definitely harder than it should be. The big thing you need is to be comfortable breaking anything you use until someone can update it (maybe forking a third-party IaC project or vendor stack, etc.) so it’s definitely less friction to remediate afterwards.
- time0ut 6y ago
  I'm sure over time they will retrofit their APIs to better support tag policy enforcement. I am glad they err on the side of maintaining a stable API, so I can see why things are the way they are. For now, we enforce our policy during code review. Everything is deployed via terraform/terragrunt so it is pretty easy. We have plans to mostly automate this via static code analysis.
  - acdha 6y ago
    Ditto — I think tools like Sentinel policies are a great answer here because it doesn't prevent your administrators from doing something in a hurry but it means that your normal flow of releases will catch missed tags. We're already using that for things like tflint/tfsec/Checkov/etc. so it's a familiar workflow.
wulfmann 6y ago
You can do this with enforced_for properties https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.html https://docs.aws.amazon.com/organizations/latest/userguide/o...
- time0ut 6y ago
  This only applies to tagging operations, which are often separate from resource creation operations. For example, you can require a particular tag on an S3 bucket, but you can still just create a completely untagged bucket. The policy doesn't come into play unless you try to tag the bucket.

acdha 6y ago

There are an increasing number of APIs where you can do this with IAM conditions but it’s definitely harder than it should be. The big thing you need is to be comfortable breaking anything you use until someone can update it (maybe forking a third-party IaC project or vendor stack, etc.) so it’s definitely less friction to remediate afterwards.

time0ut 6y ago
I'm sure over time they will retrofit their APIs to better support tag policy enforcement. I am glad they err on the side of maintaining a stable API, so I can see why things are the way they are. For now, we enforce our policy during code review. Everything is deployed via terraform/terragrunt so it is pretty easy. We have plans to mostly automate this via static code analysis.
- acdha 6y ago
  Ditto — I think tools like Sentinel policies are a great answer here because it doesn't prevent your administrators from doing something in a hurry but it means that your normal flow of releases will catch missed tags. We're already using that for things like tflint/tfsec/Checkov/etc. so it's a familiar workflow.

wulfmann 6y ago

You can do this with enforced_for properties https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.html https://docs.aws.amazon.com/organizations/latest/userguide/o...

time0ut 6y ago
This only applies to tagging operations, which are often separate from resource creation operations. For example, you can require a particular tag on an S3 bucket, but you can still just create a completely untagged bucket. The policy doesn't come into play unless you try to tag the bucket.