How do I troubleshoot and resolve issues with SCPs that use IAM tag-based restrictions?

Short description

IAM tag-based restrictions might fail when the AWS service that you specified in your SCP doesn't support Attribute-Based Access Control (ABAC). Or, the API action doesn't support tag-based conditions.

Resolution

Confirm the AWS service and API support tag-based restrictions

To check whether the AWS service supports ABAC, see Services that work with the IAM. If the service's ABAC support is Partial, then only some resources within the service support tag-based restrictions. Before you apply tags in your SCP, review the AWS User Guide for your service to determine the resources that support ABAC.

To determine the API actions that support tag-based conditions, identify the condition keys that you can use.

Common condition keys that API actions support include aws:RequestTag, aws:ResourceTag, and aws:TagKeys.

Update the SCP to use only supported condition keys

Update your SCP to include supported AWS services and API actions that support condition keys. Also, in the Resource section, specify resources instead of a wildcard (*).

For example, the following SCP snippet restricts the creation of Amazon Elastic Compute Cloud (Amazon EC2) instances that don't have a specific tag:

{
   "Effect": "Deny",
   "Action": [  
       "Ec2:RunInstances"  
   ],
   "Resource": [  
       "arn:aws:ec2:*:*:instance/*"  
   ],
   "Condition": {
       "StringNotEquals": {
           "aws:RequestTag/Name": "John"
}