--- title: Tag Enforcement in AWS - Part 1 description: Every single user on your AWS account can create resources with any keys/values. When you don’t control those tags keys/values, your cost visibility will decrease and eventually, it’ll create big problems. To solve this issue, we will create a control mechanism over our tagging strategy with the help of Tag Policies. image: https://www.bionconsulting.com/hubfs/tag_enforcement_in_aws_part_i_1x-1.webp --- [![bion-logo-122x40](https://www.bionconsulting.com/hubfs/bion-logo-122x40.png)](https://www.bionconsulting.com) - [Home](https://www.bionconsulting.com) - Services - DevOps - [DevOps as a Service](https://www.bionconsulting.com/devops-as-a-service) - [DevOps Services](https://www.bionconsulting.com/services/devops/devops-services) - [AWS DevOps Consulting](https://www.bionconsulting.com/services/devops/aws-devops-consulting) - DevSecOps - [DevSecOps Consulting](https://www.bionconsulting.com/services/devsecops) - [DevSecOps Assessment](https://www.bionconsulting.com/services/devsecops-assessment) - [Software Supply Chain Security](https://www.bionconsulting.com/partnerships/anchore) - Kubernetes - [Kubernetes Consulting](https://www.bionconsulting.com/services/kubernetes/kubernetes-consulting-services) - [Kubernetes Security](https://www.bionconsulting.com/services/kubernetes/security) - [Kubernetes Managed Services](https://www.bionconsulting.com/services/kubernetes/managed-services) - [Kubernetes Migration Services](https://www.bionconsulting.com/services/kubernetes/migration-services) - [Kubernetes Training](https://www.bionconsulting.com/services/kubernetes/training) - AWS - [AWS Security Assessment](https://www.bionconsulting.com/services/aws/security-assessment) - [AWS Cloud Security](https://www.bionconsulting.com/services/aws/cloud-security) - [AWS Architecture Design](https://www.bionconsulting.com/services/aws/architecture-design) - [AWS Managed Services](https://www.bionconsulting.com/services/aws/managed-services) - [AWS Migration Services](https://www.bionconsulting.com/services/aws/migration-services) - [AWS Cost Optimisation](https://www.bionconsulting.com/services/aws/aws-cost-optimisation) - [AWS CPPO](https://www.bionconsulting.com/services/aws/aws-cppo) - AI Infrastructure Services - [AI Platform Architecture](https://www.bionconsulting.com/ai-platform-architecture) - [Generative AI & LLM Deployment on AWS](https://www.bionconsulting.com/generative-ai-llm-deployment-aws) - [AI Platform Operations and MLOps](https://www.bionconsulting.com/ai-platform-operations-and-mlops-on-aws) - Observability & Monitoring - [New Relic](https://www.bionconsulting.com/partnerships/new-relic) - [Application Performance Monitoring](https://www.bionconsulting.com/new-relic/application-performance-monitoring) - [Observability for DevOps Teams](https://www.bionconsulting.com/new-relic/observability-for-devops-teams) - [New Relic Health Check](https://www.bionconsulting.com/services/new-relic/observability-health-check) - [SAP Monitoring with New Relic](https://www.bionconsulting.com/partnerships/new-relic/sap-monitoring-with-new-relic) - [Migration from Datadog](https://www.bionconsulting.com/partnerships/new-relic/migration-from-datadog) - Industries - [Financial Services & Insurance](https://www.bionconsulting.com/industries/financial-services-insurance) - [SaaS & ISV](https://www.bionconsulting.com/industries/saas-isv) - [Retail & E-commerce](https://www.bionconsulting.com/industries/retail-e-commerce) - [Travel & Hospitality](https://www.bionconsulting.com/industries/travel-hospitality) - [Healthcare & Life Sciences](https://www.bionconsulting.com/industries/healthcare-life-sciences) - [Education & EdTech](https://www.bionconsulting.com/industries/education-edtech) - Startups - [DaaS for Startups](https://www.bionconsulting.com/startups/devops) - [AWS Migration for Startups](https://www.bionconsulting.com/startups/aws-migration) - Partnerships - [AWS](https://www.bionconsulting.com/partnerships/aws) - [New Relic](https://www.bionconsulting.com/partnerships/new-relic) - [Anchore](https://www.bionconsulting.com/partnerships/anchore) - [Octopus](https://www.bionconsulting.com/partnerships/octopus) - [DBmaestro](https://www.bionconsulting.com/partnerships/dbmaestro) - [Eclypses](https://www.bionconsulting.com/partnerships/eclypses) - [Vanta](https://www.bionconsulting.com/partnerships/vanta) - [Palo Alto](https://www.bionconsulting.com/partnerships/palo-alto) - [About us](https://www.bionconsulting.com/about) - [Case Studies](https://www.bionconsulting.com/case-studies) - [Blog](https://www.bionconsulting.com/blog) - [Contact us](https://www.bionconsulting.com/contact-us) This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. # Tag Enforcement in AWS - Part 1 [Bion DevOps Team](https://www.bionconsulting.com/blog/author/bion-devops-team) Sep 14, 2021, 2:18:19 PM The motivation of the Blog Post; In AWS, tagging is an essential part of cost visibility and security. Unfortunately, this can lead to a problem. Every single user on your AWS account can create resources with any keys/values. When you don’t control those tags keys/values, your cost visibility will decrease and eventually, it’ll create big problems. To solve this issue, we will create a control mechanism over our tagging strategy with the help of Tag Policies. If you would like to go beyond good intentions on tagging strategy, keep on reading! ## **Beyond Good Intentions** As[Jeff Bezos](https://twitter.com/JeffBezos) often reminds us, “Good intentions don’t work, but mechanisms do.” Standardising on **names**, **values**, **capitalisation**, and **punctuation** is a great idea but challenging to put into practice. When tags are used to control access to resources or divvy up bills, small errors can create big problems! Developers or other users may not comply with tagging strategies. How do you apply and enforce strict tag policies over your whole AWS Organisation? Let’s find out! ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-2.jpeg?width=300&name=Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-2.jpeg) ## **What are AWS Organisations?** AWS Organisations help you centrally manage and govern your environment as you grow and scale your AWS resources. Using AWS Organisations, you can programmatically create new AWS accounts and allocate resources, group accounts to organise your workflows, apply policies to accounts or groups for governance, and simplify billing by using a single payment method for all of your accounts. In addition, AWS Organisations is integrated with other AWS services so you can define central configurations, security mechanisms, audit requirements, and resource sharing across accounts in your organisation. **AWS Organisations is available to all AWS customers at no additional charge**.\[[1](https://aws.amazon.com/organizations/?nc1=h_ls)\] ## **What are tag policies?** Tag policies are a type of policy that can help you standardise tags across resources in your organisation’s accounts. In a tag policy, you specify tagging rules applicable to resources when they are tagged. For example, a tag policy can specify that when the CostCenter tag is attached to a resource, it must use the case treatment and tag values that the tag policy defines. A tag policy can also specify that noncompliant tagging operations on specified resource types are enforced. In other words, noncompliant tagging requests on specified resource types are prevented from completing. Untagged resources or tags that aren't defined in the tag policy aren't evaluated for compliance with the tag policy.\[[2](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html)\] ## **Why “AWS Organisations Tag Policies” instead of “AWS Config”?** We could achieve remediation of uncompliant tags with AWS Config too. Both ways have advantages and disadvantages. AWS Config cannot instantly prevent the creation of uncompliant resources. When you define the AWS Config Rule, remediation action will work. Because of that, you will be billed partially. On the other hand, you could achieve more strict tag policies with AWS Organisations Tag Policy **for free**! ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-1.jpeg?width=402&name=Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-1.jpeg) ## **Example of the Tag Policy Scenario in Real-Life** Let’s assume that your organisation should follow a standardised tag key (costcenter) and tag value(bion-ec2-\*) for EC2 service — services supporting tag policy enforcement at the time of writing this post\[[3](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_supported-resources-enforcement.html)\]. ![Tag Enforcement in AWS - Part 1-Tag Policy](https://www.bionconsulting.com/hs-fs/hubfs/Tag%20Enforcement%20in%20AWS%20-%20Part%201-Tag%20Policy.png?width=554&name=Tag%20Enforcement%20in%20AWS%20-%20Part%201-Tag%20Policy.png) **The requirements for the scenario are:** - Your organisation must have [all features enabled](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html). - You must be signed in to your organisation’s management account. - You need to enable the permissions that are listed in [Permissions for managing tag policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html#tag-policies-permissions-manage-policies). ### **Tag policy syntax and example tag policy** A tag policy is a plaintext file that is structured according to the rules of [JSON](http://json.org/). The syntax for tag policies follows the syntax for management policy types. For a complete discussion of that syntax, see [Policy syntax and inheritance for management policy types](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inheritance_mgmt.html). This topic focuses on applying the general syntax to the specific requirements of the tag policy type. The following tag policy shows an example of tag policy syntax: | {    "tags": {        "costcenter": {            "tag\_key": {                "@@assign": "CostCenter"            },            "tag\_value": {                "@@assign": \[                    "bion-ec2-\*"                \]            },            "enforced\_for": {                "@@assign": \[                    "ec2:capacity-reservation",                     "ec2:elastic-ip",                     "ec2:fleet",                     "ec2:image",                     "ec2:instance"                \]            }        }    } } | | --- | With this policy, we defined “costcenter” as a tag key and “bion-ec2-\*” as a tag value. At the “enforced\_for” section of the tag policy, we enforce the tag key and tag value within some of the ec2 resources. More policies could add up to the 10,000 character limit within one tag policy. Also, a crucial tip is that wildcards are only allowed in **tag values**. On the other hand, tag keys should not be longer than 128 characters and can only include the following characters. “**Tag keys must be between 1-128 characters in length. Valid characters are alphanumeric, separators, and these symbols \_.:/=+-@.**” ## **Tag Enforcement with Tag Policies in Action!** First things first, you should be part of an AWS Organisation. Let’s create our organisation in AWS Management Console. Click on “Create an organisation.” ![Bion Blog Post Tag Enforcement in AWS - Part 1 - 1](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20Post%20Tag%20Enforcement%20in%20AWS%20-%20Part%201%20-%201.png?width=700&name=Bion%20Blog%20Post%20Tag%20Enforcement%20in%20AWS%20-%20Part%201%20-%201.png) *AWS Organisations home page* Great, now we are part of the organisation; the next step is to enable our organisation’s tag and service control policies. To do that, select policies on the left-hand side. In the policies, click on service control policies and tag policies, then enable these policies. ![Bion Blog Post Tag Enforcement in AWS - Part 1-2](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20Post%20Tag%20Enforcement%20in%20AWS%20-%20Part%201-2.png?width=700&name=Bion%20Blog%20Post%20Tag%20Enforcement%20in%20AWS%20-%20Part%201-2.png) ***AWS Organisations Policies Section*** After enabling service control and tag policies, you can see them as enabled in the policies section. ![Bion Blog Post:Tag Enforcement in AWS - Part 1- 3](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-Sep-13-2021-02-01-58-43-PM-1.png?width=700&name=Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-Sep-13-2021-02-01-58-43-PM-1.png) ***AWS Organisations Policies Section*** Great! We are finished with prerequisites. As a next step, we will create our tag policy. After creating the tag policy, we need to attach it to the organisation unit or organisation root. If you attach the regarding policies to the organisation root, the policies will be applied for all OUs as shown below. ![Tag Enforcement in AWS](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-3.png?height=324&name=Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-3.png) *Example chart of the Organisation Hierarchy*  \[[4](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inheritance_mgmt.html)\] In this case, I’ll attach the tag policy to the organisation’s root. ![Tag Enforcement in AWS](https://lh5.googleusercontent.com/aWZIWBH2JCJYuTvc0wqfK3WaYf_3a6GPyn7dfP4Q1XNRU9j9i7n_FJkqoas6fQvXUVRyvUMyeSuGgLXda-5sP13RgBaFZ0GBAEn0uSVUhc_MmT3cpbWtPWN9eOZwOufKVgjXB7w=s0) ***Attaching Tag Policy to the regarding organisational unit.*** ## Test Flight! For testing of our tag enforcement, I’ll try to create an EC2 instance with a non-compliant tag. I used the costcenter tag key and non-compliant-ec2 as a tag value. As we defined in our tag policy, “non-compliant-ec2” isn’t compliant, so it should not allow the creation of an EC2 instance with this tag value. ![Tag Enforcement in AWS](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-2.png?width=700&name=Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-2.png)***Example non-compliant tag value*** ![Bion Blog Post Tag Enforcement in AWS - Part 1-4](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20Post%20Tag%20Enforcement%20in%20AWS%20-%20Part%201-4.png?width=700&name=Bion%20Blog%20Post%20Tag%20Enforcement%20in%20AWS%20-%20Part%201-4.png) ***Creating an EC2 Instance with non-compliant tag key and value*** It worked like a charm! Now let’s try with a compliant tag value. As we defined in our tag policy, the tag value should be “bion-ec2-\*” in this case, so let’s try it with the following tag value “bion-ec2-blog”. ![Tag Enforcement in AWS](https://lh6.googleusercontent.com/2u9H4ekvodl7HwY7AkkBPQzbOA8kyXpiWbaHG0-b6O07ItEW3DGUJbYw81Ue9QdJAR8kKKot0JGI0W7yfWGJMeb53xuWtqNa6NeBz78mrThS1IM-p5U_oV8M0ZwaeYW5XpBosAIx=s0) ***Example compliant tag key and value*** ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-Sep-13-2021-02-01-57-31-PM.png?width=700&name=Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201-Sep-13-2021-02-01-57-31-PM.png) ***Creating an EC2 Instance with compliant tag key and value*** ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201.jpeg?width=700&name=Blog%20PostTag%20Enforcement%20in%20AWS%20-%20Part%201.jpeg) We successfully enforced our tag policy, and now we have more control over our tagging strategy. I hope you found it helpful, and if you enjoyed reading it, please don’t forget to share. In our second part of the blog post, we will do the same enforcement with Service Control Policies(SCPs) without the importance of tag values. [AWS](https://www.bionconsulting.com/blog/tag/aws) [AWS IAM](https://www.bionconsulting.com/blog/tag/aws-iam) [AWS Cost Explorer](https://www.bionconsulting.com/blog/tag/aws-cost-explorer) [AWS Organizations](https://www.bionconsulting.com/blog/tag/aws-organizations) [Enforce Tagging](https://www.bionconsulting.com/blog/tag/enforce-tagging) ## Leave a Comment ## Related Posts ### [Nov 24, 2021, 9:10:31 AM Tag Enforcement in AWS - Part 2](https://www.bionconsulting.com/blog/tag-enforcement-in-aws-part-2) ### [Jun 11, 2021, 9:33:59 AM Amazon EKS: IAM Roles for Service Accounts (IRSA)](https://www.bionconsulting.com/blog/amazon-eks-irsa) ### [Jun 10, 2026, 1:44:23 PM AI Security and Governance on AWS: How to Control LLMs in Production](https://www.bionconsulting.com/blog/ai-security-and-governance-on-aws-how-to-control-llms-in-production) ![bion-logo-white-122x40](https://www.bionconsulting.com/hubfs/bion-logo-white-122x40.png) Bion Consulting helps organisations build secure, scalable, and high-performing cloud environments. With deep expertise in DevOps, security, containerisation, observability, and AI platform operations, we deliver resilient solutions for complex and evolving business needs. - [Home](https://www.bionconsulting.com) - [DevOps](https://www.bionconsulting.com/devops-as-a-service) - [AWS](https://www.bionconsulting.com/partnerships/aws) - [New Relic](https://www.bionconsulting.com/partnerships/new-relic) - [Octopus](https://www.bionconsulting.com/partnerships/octopus) - [DBmaestro](https://www.bionconsulting.com/partnerships/dbmaestro) - [Anchore](https://www.bionconsulting.com/partnerships/anchore) - [About us](https://www.bionconsulting.com/about) - [Contact Us](https://www.bionconsulting.com/contact-us) © 2026 All rights reserved.