You can't, for example, deny an EC2 instance creation of it is NOT tagged with Key X. The recommendation is to watch cloud trail and post-creation, terminate it.

Creation events for EC2 do. It support tags, it's actually a 2 step process (the GUI console hides this, the SDK and IAM policy limits make this clear)