Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Tagging your Amazon IoT Events resources

To help you manage and organize your detector models and inputs you can optionally assign your own metadata to each of these resources in the form of tags. This section describes tags and shows you how to create them.

Tag basics

Tags enable you to categorize your Amazon IoT Events resources in different ways, for example, by purpose, owner, or environment. This is useful when you have many resources of the same type. You can quickly identify a specific resource based on the tags you've assigned to it.

Each tag consists of a key and optional value, both of which you define. For example, you could define a set of tags for your inputs that helps you track the devices that send these inputs by their type. We recommend that you create a set of tag keys that meets your needs for each kind of resource. Using a consistent set of tag keys makes it easier for you to manage your resources.

You can search for and filter resources based on the tags you add or apply, use tags to categorize and track your costs, and also use tags to control access to your resources as described in Using tags with IAM policies in the Amazon IoT Developer Guide.

For ease of use, the Tag Editor in the Amazon Web Services Management Console provides a central, unified way to create and manage your tags. For more information, see Working with Tag Editor in Working with the Amazon Web Services Management Console.

You can also work with tags using the Amazon CLI and the Amazon IoT Events API. You can associate tags with detector models and inputs when you create them by using the "Tags" field in the following commands:

You can add, modify, or delete tags for existing resources that support tagging by using the following commands:

You can edit tag keys and values, and you can remove tags from a resource at any time. You can set the value of a tag to an empty string, but you can't set the value of a tag to null. If you add a tag that has the same key as an existing tag on that resource, the new value overwrites the old value. If you delete a resource, any tags associated with the resource are also deleted.

Additional information is available in Amazon tagging strategies.

Tag restrictions and limitations

The following basic restrictions apply to tags:

Using tags with IAM policies

You can apply tag-based resource-level permissions in the IAM policies you use for Amazon IoT Events API actions. This gives you better control over what resources a user can create, modify, or use.

You use the Condition element (also called the Condition block) with the following condition context keys and values in an IAM policy to control user access (permissions) based on a resource's tags:

Controlling access using tags in the Amazon Identity and Access Management User Guide has additional information on using tags. The IAM JSON policy reference section of that guide has detailed syntax, descriptions, and examples of the elements, variables, and evaluation logic of JSON policies in IAM.

The following example policy applies two tag-based restrictions. A user restricted by this policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "iotevents:CreateDetectorModel",
                "iotevents:CreateAlarmModel",
                "iotevents:CreateInput",
                "iotevents:TagResource"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/env": "prod"
                }
            }
        },
        {
            "Effect": "Deny",
            "Action": [
                "iotevents:DescribeDetectorModel",
                "iotevents:DescribeAlarmModel",
                "iotevents:UpdateDetectorModel",
                "iotevents:UpdateAlarmModel",
                "iotevents:DeleteDetectorModel",
                "iotevents:DeleteAlarmModel",
                "iotevents:ListDetectorModelVersions",
                "iotevents:ListAlarmModelVersions",
                "iotevents:UpdateInput",
                "iotevents:DescribeInput",
                "iotevents:DeleteInput",
                "iotevents:ListTagsForResource",
                "iotevents:TagResource",
                "iotevents:UntagResource",
                "iotevents:UpdateInputRouting"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/env": "prod"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:*"
            ],
            "Resource": "*"
        }
    ]
}

You can also specify multiple tag values for a given tag key by enclosing them in a list, as follows.

            "StringEquals" : {
              "aws:ResourceTag/env" : ["dev", "test"]
            }