Prerequisites and permissions - AWS Resource Groups and Tags

Prerequisites and permissions

Before you can evaluate compliance with tag policies in AWS Resource Groups, you need to meet the requirements and set the necessary permissions.

Prerequisites for evaluating compliance with tag policies

Evaluating compliance with tag policies requires the following:

Permissions for evaluating compliance for an account

Finding noncompliant tags on an account's resources requires these permissions:

  • organizations:DescribeEffectivePolicy – To get the contents of the effective tag policy for the account.

  • tag:GetResources – To get a list of resources that do not comply with the attached tag policy.

  • tag:TagResources – To add or update tags. You also need service-specific permissions to create tags. For example, to tag resources in Amazon EC2, you need permissions for ec2:CreateTags.

  • tag:UnTagResources – To remove a tag. You also need service-specific permissions to remove tags. For example, to untag resources in Amazon EC2, you need permissions for ec2:DeleteTags.

The following example IAM policy provides permissions for evaluating tag compliance for an account.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "EvaluateAccountCompliance", "Effect": "Allow", "Action": [ "organizations:DescribeEffectivePolicy", "tag:GetResources", "tag:TagResources", "tag:UnTagResources" ], "Resource": "*" } ] }

For more information on IAM policies and permissions, see the IAM User Guide.

Permissions for evaluating organization-wide compliance

Evaluating organization-wide compliance with tag policies requires the following permissions:

  • organizations:DescribeEffectivePolicy – To get the contents of the tag policy that's attached to the organization, OU, or account.

  • tag:GetComplianceSummary – To get a summary of noncompliant resources in all accounts in the organization.

  • tag:StartReportCreation – To export the results of the most recent compliance evaluation to a file. Organization-wide compliance is evaluated every 48 hours.

  • tag:DescribeReportCreation – To check the status of report creation.

The following example IAM policy provides permissions for evaluating organization-wide compliance.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "EvaluateOrgCompliance", "Effect": "Allow", "Action": [ "organizations:DescribeEffectivePolicy", "tag:GetComplianceSummary", "tag:StartReportCreation", "tag:DescribeReportCreation" ], "Resource": "*" } ] }

For more information on IAM policies and permissions, see the IAM User Guide.

Amazon S3 bucket policy for storing report

To create an organization-wide compliance report, you must grant access for the tag policies service principal to an Amazon S3 bucket in the US East (N. Virginia) Region for report storage. Attach the following bucket policy to the bucket, replacing the placeholders with your actual S3 bucket name, and the ID number of the organization in which you're applying the policy.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "TagPolicyACL", "Effect": "Allow", "Principal": { "Service": [ "tagpolicies.tag.amazonaws.com" ] }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::your-bucket-name" }, { "Sid": "TagPolicyBucketDelivery", "Effect": "Allow", "Principal": { "Service": [ "tagpolicies.tag.amazonaws.com" ] }, "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::your-bucket-name/AwsTagPolicies/your-org-id/*" } ] }