3 ms·
FYI, IAM policies do support tag-based access control: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-tag-keys https://do
by twunde 6y ago
FYI, IAM policies do support tag-based access control: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-tag-keys https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.... This was introduced in the past 1-2 years.
- ldoughty 6y agoThat is access control when tags exist... You can't, for example, deny an EC2 instance creation of it is NOT tagged with Key X. The recommendation is to watch cloud trail and post-creation, terminate it. Creation events for EC2 do. It support tags, it's actually a 2 step process (the GUI console hides this, the SDK and IAM policy limits make this clear)
- twunde 6y agoAh, what you're looking for is SCP (service control policies). And AWS even has a handy example for denying creation when a tag is missing: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html#example-require-tag-on-create https://docs.aws.amazon.com/organizations/latest/userguide/o...