Enforce Tag Value - amazon-web-services

Question

I was trying a policy to predefine the tag value so that the instance should not be created if you don't create required tag and its value while you launch i,e the instance should have costcenter and dept as tags and value should be 115 and the prod. Then only we should be able to launch the instance. Can someone help me in this policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:Describe*",
"ec2:GetConsole*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:region::image/*",
"arn:aws:ec2:region:account:subnet/*",
"arn:aws:ec2:region:account:network-interface/*",
"arn:aws:ec2:region:account:security-group/*",
"arn:aws:ec2:region:account:key-pair/*"
]
},
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region:account:instance/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/costcenter": "115",
"aws:RequestTag/dept": "prod"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"costcenter",
"dept"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:region:account:*/*",
"Condition": {
"StringEquals": {
"ec2:CreateAction": "RunInstances"
}
}
}
]
}

Answer 1

you can try this sample which will deny action if only one tag is present, you can modify the code with your tags multiple blocks state for multiple policy :
{
"Sid": "AllowLaunchOnlyWithRequiredTags1",
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:us-east-1:accountid:instance/*",
"Condition": {
"Null": {"aws:RequestTag/costcenter": "true"}
}
},
{
"Sid": "AllowLaunchOnlyWithRequiredTags2",
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:us-east-1:accountid:instance/*",
"Condition": {
"Null": {"aws:RequestTag/stack": "true"}
}
}
Furthermore you can list the tag enforcement as :
"Condition": {
"StringEquals": {
"aws:RequestTag/costcenter": "115",
"aws:RequestTag/stack": "prod"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": ["costcenter","stack"]
}
}
According to AWS Documents for ForAllValues
the ForAllValues qualifier requires all requested values to be listed
in the policy
Another way You could do something using StringLike or StringNotLike, but it's limited to wildcards if that works for you.
Something Like :
"Statement": [
{
"Sid": "DenyMissingTags",
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:us-east-1:accountid:instance/*",
"Condition": {
"StringLike": [
"aws:RequestTag/costcenter": "*",
"aws:RequestTag/stack": "*"
]
}
}
]
Refer this