I'm a big AWS fan and heavy user for 5 years now, but it seems silly to me that you need to write a custom wrapper (e.g. force the creation through a managed script/template like Terraform/Ansible/CF)... Or write reactionary cloud trail policies to handle a situation where someone launches an EC2 instance without providing a specific tag.
The fact IAM policies still can't deny requests missing a tag, or deny requests by tag-value condition seems silly to me... Or one step further: allowing some auto-populated tags like what principle was responsible for making the instance in the first place.
You can't, for example, deny an EC2 instance creation of it is NOT tagged with Key X. The recommendation is to watch cloud trail and post-creation, terminate it.
Creation events for EC2 do. It support tags, it's actually a 2 step process (the GUI console hides this, the SDK and IAM policy limits make this clear)
Am I missing something here? I could have sworn that aws:RequestTag with a “Tag On Create” Actions would enforce the authorization check based on the in the Tags parameter? Similarly aws:TagKeys allows you to control the permitted values of those Tags.
> allowing some auto-populated tags like what principle was responsible for making the instance in the first place.
These do exist as “system tags”, but its on a per service basis. Migration Hib and ECS come to mind. I dont know of any cross cutting application (like IAM) where theyre applied universally.
https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags... https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags... https://aws.amazon.com/about-aws/whats-new/2020/04/aws-migra...
Can't it, though?
"Condition": {
"StringEquals": {
"aws:RequestTag/key1": "value1",
"aws:RequestTag/key2": "value2"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"key1",
"key2"
]
}
}A possible fix is to allow custom deny reasons but large changes like this to any already extremely large and entangled system like IAM is unlikely.
They've been steadily improving/fixing it, but for some resources, tagging new resources via the console is a 2 step process - it creates the resource THEN adds the tags. They are fixing these things so it's all added at once.
What this does is block the ability to create some resources via console since you can't add tags at creation
Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Ta...
https://github.com/terraform-providers/terraform-provider-aw...