Ah, what you're looking for is SCP (service control policies). And AWS even has a handy example for denying creation when a tag is missing: https://docs.aws.ama

Ah, what you're looking for is SCP (service control policies). And AWS even has a handy example for denying creation when a tag is missing: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html#example-require-tag-on-create https://docs.aws.amazon.com/organizations/latest/userguide/o...