> The fact IAM policies still can't deny requests missing a tag, or deny requests by tag-value condition seems silly to me... Am I missing something here? I co

> The fact IAM policies still can't deny requests missing a tag, or deny requests by tag-value condition seems silly to me... Am I missing something here? I could have sworn that aws:RequestTag with a “Tag On Create” Actions would enforce the authorization check based on the in the Tags parameter? Similarly aws:TagKeys allows you to control the permitted values of those Tags. > allowing some auto-populated tags like what principle was responsible for making the instance in the first place. These do exist as “system tags”, but its on a per service basis. Migration Hib and ECS come to mind. I dont know of any cross cutting application (like IAM) where theyre applied universally. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-requests https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags... https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-tag-keys https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags... https://aws.amazon.com/about-aws/whats-new/2020/04/aws-migration-hub-automatically-tags-migration-results-cost-tracking/ https://aws.amazon.com/about-aws/whats-new/2020/04/aws-migra...