Getting started with tag policies

Step 1: Enable tag policies for your organization.

The organization's management account.¹

Amazon Organizations

Step 2: Create a tag policy.

Keep your first tag policy simple. Enter one tag key in the case treatment you want to use and leave all other options at their defaults.

The organization's management account.¹

Amazon Organizations

Step 3: Attach a tag policy to a single member account that you can use for testing.

You'll need to sign in to this account in the next step.

The organization's management account.¹

Amazon Organizations

Step 4: Create some resources with compliant tags and some with noncompliant tags.

The member account that you're using for testing purposes.

Any Amazon service that you are comfortable with. For example, you can use Amazon Secrets Manager and follow the procedure in Creating a Basic Secret to create secrets with compliant and non-compliant secrets.

Step 5: View the effective tag policy and evaluate the compliance status of the account.

The member account that you're using for testing purposes.

Resource Groups and the Amazon service where the resource was created.

If you created resources with compliant and non-compliant tags, you should see the non-compliant tags in the results.

Step 6: Repeat the process of finding and correcting compliance issues until the resources in the test account are compliant with your tag policy.

The member account that you're using for testing purposes.

Resource Groups and the Amazon service where the resource was created.

At any time, you can evaluate organization-wide compliance.

The organization's management account.¹

Resource Groups

Create more advanced tag policies.

Follow the same process as for first-time users, but try other tasks. For example, define additional keys or values or specify different case treatment for a tag key.

You can use the information in Understanding management policy inheritance and Tag policy syntax to create more detailed tag policies.

The organization's management account.¹

Amazon Organizations

Attach tag policies to additional accounts or OUs.

Check the effective tag policy for an account after you attach more policies to it or to any OU in which the account is a member.

The organization's management account.¹

Amazon Organizations

Create an SCP to require tags when anyone creates new resources. For an example, see Require a tag on specified created resources.

The organization's management account.¹

Amazon Organizations

Continue to evaluate the compliance status of the account against the effective tag policy as it changes. Correct noncompliant tags.

A member account with an effective tag policy.

Resource Groups and the Amazon service where the resource was created.

Evaluate organization-wide compliance.

The organization's management account.¹

Resource Groups

Step 1: Create a tag policy.

Keep your first enforced tag policy simple. Enter one tag key in the case treatment you want to use, and choose the Prevent noncompliant operations for this tag option. Then specify one resource type to enforce it on. Continuing with our earlier example, you can choose to enforce it on Secrets Manager secrets.

The organization's management account.¹

Amazon Organizations

Step 2: Attach a tag policy to a single, test account.

The organization's management account.¹

Amazon Organizations

Step 3: Try creating some resources with compliant tags, and some with noncompliant tags. You shouldn't be allowed to create a tag on a resource of the type specified in the tag policy with a noncompliant tag.

The member account that you're using for testing purposes.

Step 4: Evaluate the compliance status of the account against the effective tag policy and correct noncompliant tags.

The member account that you're using for testing purposes.

Resource Groups and the Amazon service where the resource was created.

Step 5: Repeat the process of finding and correcting compliance issues until the resources in the test account are compliant with your tag policy.

The member account that you're using for testing purposes.

Resource Groups and the Amazon service where the resource was created.

At any time, you can evaluate organization-wide compliance.

The organization's management account.¹

Resource Groups