Enforcing Tagging Using Tagging Policies and Service Control Policies

Overview

Tagging in AWS is a crucial practice for resource management, cost allocation, and access control. However, ensuring consistent tagging across all resources in a multi-account environment can be challenging. By leveraging Tagging Policies and Service Control Policies (SCPs), AWS organizations can enforce tagging rules effectively, ensuring resources are consistently and correctly tagged. This blog will guide you through implementing tagging enforcement at the organization level.

Why Enforce Tagging?

Tagging resources systematically provides several benefits:

1. Cost Management: Track costs effectively by grouping resources with specific tags.
2. Resource Organization: Simplify resource discovery and management.
3. Access Control: Use tags with IAM policies to grant or restrict permissions.
4. Compliance and Governance: Ensure resources adhere to organizational standards.

Tagging Policies: Enforcing Tagging Standards

Tagging Policies are JSON-based policies that define rules for tags, such as allowed keys, values, and formats. These policies are applied at the AWS Organizations level, ensuring all member accounts comply with the defined tagging standards.

Key Features of Tagging Policies

• Enforce tagging requirements for new and existing resources.
• Specify tag key formats (e.g., lowercase letters or specific prefixes).
• Validate tag values against allowed patterns.

How to Implement Tagging Policies

1. Enable Tag Policies:
   • In the AWS Management Console, navigate to AWS Organizations.
   • Enable Tag Policies for your organization.
2. Create a Tag Policy:
   • Define the tagging rules in JSON format. For example:
     { "tags": { "Environment": { "tag_key": { "enforced_for": ["ec2:instance", "s3:bucket"] }, "tag_value": { "allowed_pattern": "^(dev|staging|prod)$" } }, "Owner": { "tag_key": { "enforced_for": ["*"] } } } }

     1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

     {   "tags": {     "Environment": {       "tag_key": {         "enforced_for": ["ec2:instance", "s3:bucket"]       },       "tag_value": {         "allowed_pattern": "^(dev|staging|prod)$"       }     },     "Owner": {       "tag_key": {         "enforced_for": ["*"]       }     }   } }

      

3. Attach the Tag Policy to Organizational Units (OUs):
   • Assign the policy to specific accounts or OUs within your organization.
4. Monitor Compliance:
   • Use the AWS Tag Editor or AWS Config to identify non-compliant resources.

Service Control Policies (SCPs): Restricting Actions Based on Tags

Service Control Policies (SCPs) act as permission boundaries, defining what actions users and services can perform within an AWS Organization. SCPs can be used alongside tagging policies to enforce tagging by preventing specific actions on untagged resources.

Key Features of SCPs

• Apply restrictions at the account, OU, or organization level.
• Deny actions based on resource tag compliance.
• Ensure security and governance by restricting resource creation without proper tagging.

How to Implement SCPs for Tag Enforcement

1. Enable SCPs:
   • In the AWS Organizations console, enable SCPs.
2. Create an SCP for Tagging Compliance:
   • Define a policy to deny actions on untagged resources. Example:
     { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "StringNotEqualsIfExists": { "aws:RequestTag/Environment": ["dev", "staging", "prod"] } } } ] }

     1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

     {   "Version": "2012-10-17",   "Statement": [     {       "Effect": "Deny",       "Action": "*",       "Resource": "*",       "Condition": {         "StringNotEqualsIfExists": {           "aws:RequestTag/Environment": ["dev", "staging", "prod"]         }       }     }   ]   }

      

3. Attach SCPs to OUs or Accounts:
   • Apply the policy to enforce compliance across your organization.
4. Test and Monitor:
   • Test the SCPs in a controlled environment to ensure they work as intended without disrupting workflows.

Best Practices for Tagging Enforcement

1. Combine Tagging Policies and SCPs:
   • Use tagging policies to standardize tags and SCPs to enforce compliance.
2. Use Automated Tools:
   • Automate tagging with AWS Lambda or AWS Config rules to remediate non-compliant resources.
3. Regular Audits:
   • Periodically review tag compliance using AWS tools like Resource Groups and AWS Cost Explorer.
4. Communicate Standards:
   • Train teams on tagging importance and provide clear guidelines.

Conclusion

Enforcing tagging using Tagging Policies and SCPs ensures a consistent, organized, and compliant AWS environment. By leveraging these AWS features, organizations can improve cost management, simplify resource management, and enhance governance. Start enforcing your tagging standards today to unlock the full potential of AWS resource management.

About CloudThat

CloudThat is a leading provider of Cloud Training and Consulting services with a global presence in India, the USA, Asia, Europe, and Africa. Specializing in AWS, Microsoft Azure, GCP, VMware, Databricks, and more, the company serves mid-market and enterprise clients, offering comprehensive expertise in Cloud Migration, Data Platforms, DevOps, IoT, AI/ML, and more.

CloudThat is the first Indian Company to win the prestigious Microsoft Partner 2024 Award and is recognized as a top-tier partner with AWS and Microsoft, including the prestigious ‘Think Big’ partner award from AWS and the Microsoft Superstars FY 2023 award in Asia & India. Having trained 650k+ professionals in 500+ cloud certifications and completed 300+ consulting projects globally, CloudThat is an official AWS Advanced Consulting Partner, Microsoft Gold Partner, AWS Training Partner, AWS Migration Partner, AWS Data and Analytics Partner, AWS DevOps Competency Partner, AWS GenAI Competency Partner, Amazon QuickSight Service Delivery Partner, Amazon EKS Service Delivery Partner,  AWS Microsoft Workload Partners, Amazon EC2 Service Delivery Partner, Amazon ECS Service Delivery Partner, AWS Glue Service Delivery Partner, Amazon Redshift Service Delivery Partner, AWS Control Tower Service Delivery Partner, AWS WAF Service Delivery Partner, Amazon CloudFront and many more.

To get started, go through our Consultancy page and Managed Services Package, CloudThat’s offerings.