Example: Restrict the compute resource tag keys a principal can set

The following identity-based policy, which you attach to an IAM user or role, allows a principal to create and update compute environments, but only when every tag key in computeResources.tags is CostCenter, Team, or Project. Requests that set any other tag key are denied.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowComputeEnvironmentManagement",
      "Effect": "Allow",
      "Action": [
        "batch:CreateComputeEnvironment",
        "batch:UpdateComputeEnvironment"
      ],
      "Resource": "arn:aws:batch:us-east-1:123456789012:compute-environment/*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "batch:ComputeResourcesTagKeys": ["CostCenter", "Team", "Project"]
        }
      }
    }
  ]
}

This policy restricts the request to the allowed tag keys, but it doesn't require the request to set any of them. The ForAllValues set operator is satisfied even when the request sets no compute resource tags. To also require that a specific tag key is always present, add a statement that uses the Null operator on batch:ComputeResourcesTag/tag-key. For an example, see Resource: Restrict the Amazon EC2 tags a principal can set on compute resources.

You can combine both condition keys in a single statement to restrict the allowed tag keys and the value permitted for one of those keys at the same time. The following policy allows a principal to create and update compute environments only when the CostCenter tag value is engineering, and only when no tag key other than CostCenter, Team, or Project is used.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowComputeEnvironmentManagementWithApprovedTags",
      "Effect": "Allow",
      "Action": [
        "batch:CreateComputeEnvironment",
        "batch:UpdateComputeEnvironment"
      ],
      "Resource": "arn:aws:batch:us-east-1:123456789012:compute-environment/*",
      "Condition": {
        "StringEquals": {
          "batch:ComputeResourcesTag/CostCenter": "engineering"
        },
        "ForAllValues:StringEquals": {
          "batch:ComputeResourcesTagKeys": ["CostCenter", "Team", "Project"]
        }
      }
    }
  ]
}