--- title: Tag Enforcement in AWS - Part 2 description: In this blog post, we will explain how to successfully enforce our tag key with the help of the service control policies and have more control over our tagging strategy. image: https://www.bionconsulting.com/hubfs/Tag%20Enforcement%20in%20AWS%20-%20Part%202.jpg --- [![bion-logo-122x40](https://www.bionconsulting.com/hubfs/bion-logo-122x40.png)](https://www.bionconsulting.com) - [Home](https://www.bionconsulting.com) - Services - DevOps - [DevOps as a Service](https://www.bionconsulting.com/devops-as-a-service) - [DevOps Services](https://www.bionconsulting.com/services/devops/devops-services) - [AWS DevOps Consulting](https://www.bionconsulting.com/services/devops/aws-devops-consulting) - DevSecOps - [DevSecOps Consulting](https://www.bionconsulting.com/services/devsecops) - [DevSecOps Assessment](https://www.bionconsulting.com/services/devsecops-assessment) - [Software Supply Chain Security](https://www.bionconsulting.com/partnerships/anchore) - Kubernetes - [Kubernetes Consulting](https://www.bionconsulting.com/services/kubernetes/kubernetes-consulting-services) - [Kubernetes Security](https://www.bionconsulting.com/services/kubernetes/security) - [Kubernetes Managed Services](https://www.bionconsulting.com/services/kubernetes/managed-services) - [Kubernetes Migration Services](https://www.bionconsulting.com/services/kubernetes/migration-services) - [Kubernetes Training](https://www.bionconsulting.com/services/kubernetes/training) - AWS - [AWS Security Assessment](https://www.bionconsulting.com/services/aws/security-assessment) - [AWS Cloud Security](https://www.bionconsulting.com/services/aws/cloud-security) - [AWS Architecture Design](https://www.bionconsulting.com/services/aws/architecture-design) - [AWS Managed Services](https://www.bionconsulting.com/services/aws/managed-services) - [AWS Migration Services](https://www.bionconsulting.com/services/aws/migration-services) - [AWS Cost Optimisation](https://www.bionconsulting.com/services/aws/aws-cost-optimisation) - [AWS CPPO](https://www.bionconsulting.com/services/aws/aws-cppo) - AI Infrastructure Services - [AI Platform Architecture](https://www.bionconsulting.com/ai-platform-architecture) - [Generative AI & LLM Deployment on AWS](https://www.bionconsulting.com/generative-ai-llm-deployment-aws) - [AI Platform Operations and MLOps](https://www.bionconsulting.com/ai-platform-operations-and-mlops-on-aws) - Observability & Monitoring - [New Relic](https://www.bionconsulting.com/partnerships/new-relic) - [Application Performance Monitoring](https://www.bionconsulting.com/new-relic/application-performance-monitoring) - [Observability for DevOps Teams](https://www.bionconsulting.com/new-relic/observability-for-devops-teams) - [New Relic Health Check](https://www.bionconsulting.com/services/new-relic/observability-health-check) - [SAP Monitoring with New Relic](https://www.bionconsulting.com/partnerships/new-relic/sap-monitoring-with-new-relic) - [Migration from Datadog](https://www.bionconsulting.com/partnerships/new-relic/migration-from-datadog) - Industries - [Financial Services & Insurance](https://www.bionconsulting.com/industries/financial-services-insurance) - [SaaS & ISV](https://www.bionconsulting.com/industries/saas-isv) - [Retail & E-commerce](https://www.bionconsulting.com/industries/retail-e-commerce) - [Travel & Hospitality](https://www.bionconsulting.com/industries/travel-hospitality) - [Healthcare & Life Sciences](https://www.bionconsulting.com/industries/healthcare-life-sciences) - [Education & EdTech](https://www.bionconsulting.com/industries/education-edtech) - Startups - [DaaS for Startups](https://www.bionconsulting.com/startups/devops) - [AWS Migration for Startups](https://www.bionconsulting.com/startups/aws-migration) - Partnerships - [AWS](https://www.bionconsulting.com/partnerships/aws) - [New Relic](https://www.bionconsulting.com/partnerships/new-relic) - [Anchore](https://www.bionconsulting.com/partnerships/anchore) - [Octopus](https://www.bionconsulting.com/partnerships/octopus) - [DBmaestro](https://www.bionconsulting.com/partnerships/dbmaestro) - [Eclypses](https://www.bionconsulting.com/partnerships/eclypses) - [Vanta](https://www.bionconsulting.com/partnerships/vanta) - [Palo Alto](https://www.bionconsulting.com/partnerships/palo-alto) - [About us](https://www.bionconsulting.com/about) - [Case Studies](https://www.bionconsulting.com/case-studies) - [Blog](https://www.bionconsulting.com/blog) - [Contact us](https://www.bionconsulting.com/contact-us) This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. # Tag Enforcement in AWS - Part 2 [Bion DevOps Team](https://www.bionconsulting.com/blog/author/bion-devops-team) Nov 24, 2021, 9:10:31 AM In this blog post, we will continue to explain how to go beyond good intentions with your tagging strategy in AWS. ![](https://www.bionconsulting.com/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202.jpeg) Thanks to Service Control Policies (SCPs), we will show how they can strictly enforce policies without the importance of values in tags. If you are not familiar with tag policies and AWS Organisations or missed part 1 of this blog post series, please check it out[ here\[1\]](https://www.bionconsulting.com/blog/tag-enforcement-in-aws-part-1). ## **What are service control policies (SCPs)?** Service control policies (SCPs) are a type of organisation policy that you can use to manage permissions in your organisation. **SCPs offer central control over the maximum available permissions for all accounts in your organisation. SCPs help you to ensure your accounts stay within your organisation's access control guidelines**. SCPs are available only in an organisation that has [all features enabled](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html). SCPs aren't available if your organisation has enabled only the consolidated billing features. For instructions on enabling SCPs, see [Enabling and disabling policy types](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_enable-disable.html).\[[2](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html)\] **Important!** **SCPs don't affect users or roles in the management account. They affect only the member accounts in your organisation.** **The Maximum size of SCPs** All characters in your SCP count against its [maximum size](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_limits.html#min-max-values). The examples in this blog post show the SCPs formatted with extra white space to improve their readability. If your Service Control Policy approaches the maximum size, you can delete any white space, such as space characters and line breaks outside quotation marks. **Inheritance of Service Control Policies** Inheritance for Service Control Policies behaves like a filter through which permissions flow to all parts of the tree below. ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-Nov-22-2021-12-28-07-13-PM.png?height=324&name=Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-Nov-22-2021-12-28-07-13-PM.png) **Example Organisation Inheritance Tree** \[[3](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inheritance_mgmt.html)\] Imagine that the inverted tree structure of the organisation is made of branches that connect from the root to each of the OUs and end at the accounts. All AWS permissions flow into the root of the tree. Those permissions must then flow past the SCPs attached to the root, OUs, and the account to get to the principal (an IAM role or user) making a request. Each SCP can filter the permissions passing through to the levels below it. If an action is blocked by a **deny** statement, then all OUs and accounts affected by that SCP are denied access to that action. An SCP at a lower level can't add permission after it is blocked by an SCP at a higher level. SCPs can only filter; they never add permissions. SCPs do not support inheritance operators that alter how elements of the policy are inherited by child OUs and accounts. The following illustration shows how [SCPs](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) work. ![](https://www.bionconsulting.com/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-Nov-22-2021-12-28-07-80-PM.png) **Example chart of the Inheritance of Service Control Policies (SCPs)**\[[4](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inheritance_auth.html)\] ## **What are the differences between Service Control Policies (SCPs) and Tag Policies?** Both are the types of organisation policies, SCP(s) have more use cases than Tag Policies. Tag Policies can be used only for tagging related policies. In tag policies, tag key and value should match with the applied tag policy. Service control policies can accept any value with a compliant key. Both can be used for the strictest possible tag enforcement in AWS. I'll mention this perfect combination later on.\[[5](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html#scp-size-limit)\] **Service Control Policy (SCPs) syntax and an example service control policy** Service control policies (SCPs) use a similar syntax to those used by AWS Identity and Access Management (IAM) permission policies and resource-based policies (like Amazon S3 bucket policies). For more information about IAM policies and their syntax, see [Overview of IAM Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the IAM User Guide. An SCP is a plaintext file that is structured according to the rules of [JSON](http://json.org/), and it uses the elements that are described in this topic.\[[6](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_syntax.html)\] The following service control policy shows a sample "service control policy" syntax: | {  "Version": "2012-10-17",  "Statement": \[    {      "Sid": "Name",      "Effect": "Deny",      "Action": "ec2:RunInstances",      "Resource": \[        "arn:aws:ec2:\*:\*:instance/\*",        "arn:aws:ec2:\*:\*:volume/\*"      \],      "Condition": {        "Null": {          "aws:RequestTag/Name": "true"        }      }    }  \] } | | --- | ***Example Service Control Policy*** With this policy, we defined the action "ec2:RunInstances" which means this policy will take effect while running EC2 instances. At the "Resource" section of the Service Control Policy, we define which tag will be checked on EC2. In this case, we are checking instance tags and volume tags. We've used a Null condition operator to check if a condition key is present at the time of authorisation. In the policy statement, use either true (the key doesn't exist — it is null) or false (the key exists and its value is not null).\[[7](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html)\]  Finally, at the "Condition" section of the Service Control Policy, we enforce the tag key; in this case, the tag key is called "Name". In conclusion, our Service Control Policy will take effect while running instances and will check tag keys on volumes and instances, and both should have a "Name" tag key as a value for those tag keys. ## **The Perfect Combination of Tag Policies and Service Control Policies (Optional)** If you would like to be more strict with your tagging strategy, you could use both of them. If you are not familiar with tag policies and AWS Organisations or missed part 1 of this blog post series, please review it [here\[8\]](https://www.bionconsulting.com/blog/tag-enforcement-in-aws-part-1). As we explained earlier in this blog post, Service Control Policies don't check the values of the tags but tag policies do. Because of that, the validation will be based only on tag keys. Just enable both Policies from AWS Organisations, create a tag policy and service control policy based on your needs. Tada! That's all you need to do! ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-2.png?width=800&name=Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-2.png)***Enabling Service Control Policy and Tag Policy*** ## **Tag Enforcement with Service Control Policies in Action!** First things first, you should be a part of the AWS Organisation. If you haven't already enabled the AWS Organisations or aren't sure about how to enable policies on your organisation, please check [here\[9\]](https://www.bionconsulting.com/blog/tag-enforcement-in-aws-part-1) to find out more. I'm assuming that you have already enabled AWS Organisations. The next step is to enable our organisation's service control policies. To do that, select **policies** on the left-hand side, then click on **service control policies** and enable it. ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-Nov-22-2021-12-28-07-35-PM.png?width=800&name=Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-Nov-22-2021-12-28-07-35-PM.png) **AWS Organisations Policies Section** Great! We are done with prerequisites, and as a next step, we will create our service control policy. After creating the service control policy, we need to attach it to the organisational unit or organisation root. If you attach the policies to the organisation root, the policies will be applied for all OUs as shown below. **Reminder!** **SCPs don't affect users or roles in the management account. They affect only the member accounts in your organisation.** In this case, I'll attach the tag policy to the organisation's root. So, as we explained earlier in this blog post, if you attach an organisation policy to organisation root, all the OU and accounts inherit that policy. ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-1.png?width=800&name=Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-1.png)***Attaching Service Control Policy to the organisational unit.*** ## Test Flight! For testing our tag enforcement, I'll try to create an EC2 instance with a non-compliant tag with a tag key Bion. As we defined in our Service Control Policy, "Bion" is not a compliant key, so it should not allow the creation of an EC2 instance with this tag key. ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202.png?width=800&name=Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202.png) ***Example non-compliant Tag Key*** ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-4.png?width=800&name=Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-4.png)***Creating an EC2 Instance with non-compliant tag key*** It worked as expected. Let's see the decoded authorisation failure message. **Don't you know how to enable encoded messages?** No worries, you just need to replace the  with your own encoded message. Then run the below command. You should also have the required permissions and configured aws cli to do that.\[[10](https://docs.aws.amazon.com/cli/latest/reference/sts/decode-authorization-message.html)\] | aws sts decode-authorization-message --encoded-message | | --- | | {  "DecodedMessage": "{\\"allowed\\":false,\\"explicitDeny\\":true,\\"matchedStatements\\":{\\"items\\":\[{\\"statementId\\":\\"Name\\",\\"effect\\":\\"DENY\\",\\"principals\\":{\\"items\\":\[{\\"value\\":\\"111111111111111\\"}\]},\\"principalGroups\\":{\\"items\\":\[\]},\\"actions\\":{\\"items\\":\[{\\"value\\":\\"ec2:RunInstances\\"}\]},\\"resources\\":{\\"items\\":\[{\\"value\\":\\"arn:aws:ec2:\*:\*:instance/\*\\"},{\\"value\\":\\"arn:aws:ec2:\*:\*:volume/\*\\"}\]},\\"conditions\\":{\\"items\\":\[{\\"key\\":\\"aws:RequestTag/Name\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"true\\"}\]}}\]}}\]},\\"failures\\":{\\"items\\":\[\]},\\"context\\":{\\"principal\\":{\\"id\\":\\"111111111111111\\",\\"arn\\":\\"arn:aws:iam::111111111111111:root\\"},\\"action\\":\\"ec2:RunInstances\\",\\"resource\\":\\"arn:aws:ec2:eu-central-1:111111111111111:instance/\*\\",\\"conditions\\":{\\"items\\":\[{\\"key\\":\\"ec2:MetadataHttpPutResponseHopLimit\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"1\\"}\]}},{\\"key\\":\\"ec2:InstanceMarketType\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"on-demand\\"}\]}},{\\"key\\":\\"aws:Resource\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"instance/\*\\"}\]}},{\\"key\\":\\"aws:Account\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"111111111111111\\"}\]}},{\\"key\\":\\"ec2:AvailabilityZone\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"eu-central-1b\\"}\]}},{\\"key\\":\\"ec2:ebsOptimized\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"false\\"}\]}},{\\"key\\":\\"ec2:IsLaunchTemplateResource\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"false\\"}\]}},{\\"key\\":\\"ec2:InstanceType\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"t2.micro\\"}\]}},{\\"key\\":\\"ec2:RootDeviceType\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"ebs\\"}\]}},{\\"key\\":\\"aws:Region\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"eu-central-1\\"}\]}},{\\"key\\":\\"ec2:MetadataHttpEndpoint\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"enabled\\"}\]}},{\\"key\\":\\"aws:Service\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"ec2\\"}\]}},{\\"key\\":\\"ec2:InstanceID\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"\*\\"}\]}},{\\"key\\":\\"ec2:MetadataHttpTokens\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"optional\\"}\]}},{\\"key\\":\\"aws:Type\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"instance\\"}\]}},{\\"key\\":\\"ec2:Tenancy\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"default\\"}\]}},{\\"key\\":\\"ec2:Region\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"eu-central-1\\"}\]}},{\\"key\\":\\"aws:ARN\\",\\"values\\":{\\"items\\":\[{\\"value\\":\\"arn:aws:ec2:eu-central-1:111111111111111:instance/\*\\"}\]}}\]}}}" } | | --- | ***Decoded error message*** Now let's try with a compliant tag key. Earlier in this blog post, we defined the compliant tag key as "Name" without the importance of the tag value. In this case, let's try with the following tag value "bion-scp-ec2". ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-3.png?width=800&name=Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-3.png)**Example compliant Tag Key** ![](https://www.bionconsulting.com/hs-fs/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-Nov-22-2021-12-28-07-99-PM.png?width=800&name=Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-Nov-22-2021-12-28-07-99-PM.png)**Creating an EC2 Instance with compliant tag key** ![](https://www.bionconsulting.com/hubfs/Google%20Drive%20Integration/Bion%20Blog%20-Tag%20Enforcement%20in%20AWS%20-%20Part%202-2.jpeg) We successfully enforced our tag key with the help of the service control policies and now we have more control over our tagging strategy. I hope you found this helpful. If you enjoyed reading it, please don't forget to share. [AWS](https://www.bionconsulting.com/blog/tag/aws) [AWS IAM](https://www.bionconsulting.com/blog/tag/aws-iam) [AWS Cost Explorer](https://www.bionconsulting.com/blog/tag/aws-cost-explorer) [AWS Organizations](https://www.bionconsulting.com/blog/tag/aws-organizations) [Enforce Tagging](https://www.bionconsulting.com/blog/tag/enforce-tagging) ## Leave a Comment ## Related Posts ### [Sep 14, 2021, 2:18:19 PM Tag Enforcement in AWS - Part 1](https://www.bionconsulting.com/blog/tag-enforcement-in-aws-part-1) ### [Jun 10, 2026, 1:44:23 PM AI Security and Governance on AWS: How to Control LLMs in Production](https://www.bionconsulting.com/blog/ai-security-and-governance-on-aws-how-to-control-llms-in-production) ### [Jun 2, 2026, 2:52:19 PM How to Build Production-Ready LLM Deployments on AWS](https://www.bionconsulting.com/blog/how-to-build-production-ready-llm-deployments-on-aws) ![bion-logo-white-122x40](https://www.bionconsulting.com/hubfs/bion-logo-white-122x40.png) Bion Consulting helps organisations build secure, scalable, and high-performing cloud environments. With deep expertise in DevOps, security, containerisation, observability, and AI platform operations, we deliver resilient solutions for complex and evolving business needs. - [Home](https://www.bionconsulting.com) - [DevOps](https://www.bionconsulting.com/devops-as-a-service) - [AWS](https://www.bionconsulting.com/partnerships/aws) - [New Relic](https://www.bionconsulting.com/partnerships/new-relic) - [Octopus](https://www.bionconsulting.com/partnerships/octopus) - [DBmaestro](https://www.bionconsulting.com/partnerships/dbmaestro) - [Anchore](https://www.bionconsulting.com/partnerships/anchore) - [About us](https://www.bionconsulting.com/about) - [Contact Us](https://www.bionconsulting.com/contact-us) © 2026 All rights reserved.