SCP in Organization to restrict the creation of EC2 instance, volumes without mandatory tags

Question

I have added a SCP in Organization to restrict the creation of EC2 instance, volumes without mandatory tags. Manual creation of instances with mandatory tags is working fine. when I pass all the tags inside CloudFormation it fails to create instance.

Policy

    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyRunInstanceWithNoProjectTag",
            "Effect": "Deny",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:volume/*"
            ],
            "Condition": {
                "Null": {
                    "aws:RequestTag/AppID": "true"
                }
            }
        }
    ]
}

Error Message:

API: ec2:RunInstances You are not authorized to perform this operation. Encoded authorization failure message: ghoOCHN7ZLl0rvdRObGsJeDyE86Nt0lqYYAhVmOHGu7J2zGxbuDWa3VyYl75TfChof_km2U-_Eo4c9Kq6qY_XvmTN-nZa3inB6QEVG0OvOokZuFyFiOS0vSIorhW2uwVmI8w25Fqgf5ueBH0bxq5BnmY7gTCcI9NjCHzEpBY4nudbrNm1iNfQSPldof4CwmibMip_Cs-JgQ2vV76wjo0DgLQDDp6Yzk65-Std9ihGqnlE8DiHBE_dKiUNQtfqXcJ8jsAjjnP-DSmHBprg-IjB-bsOWHElylusj-zCDKby44xiLnG1sv_7pbIhFPcV5gezCaTufGlB9wkZxFuncYPl5Uv6xsL7CmGi_UXHcKeyQpLxMwXRBuo6SWTplsI67_LLskvvj00Kj8_8XDi5kz87B9kkWSiBoykgDHVZPngK6DSMv1YhPAbDu03oVw3wdYxzQO3MwoX-tXGJN63NtYhf-gDo-G9YF599zWSX5kT41FJlmuYDBn7nDPrXpXZLAhIjyulUnQOzuz4aEG_xWDiY-ZAZNuI6o7Df_K0OuI3xU-qKpgssSUt6bR6goHoaQJ_NDSzzoodusYtk69RPv_Pyom5WETfOv9zfGtKAkmn5Sk4NTP7T0rYClOnaUvx_MkKy1Lk6jFGYNfROqs96UIxBsYUhD-QEOjRZQ4-L7GSNIn3cZfCHJ9e5ZuPflQpMQsRiV9tUIessOC8uKnGYRZw4cSeCNzTgjLypcCbFchf01qdFsB4TrTtOTRMzYf1-ImBg4CY3CycmZ8Cduv_wSWTw

Cloudformation:

Description: CloudFormation template to create Windows2016 VM
Parameters:
  vpcid:
    Type: String
  subnetid1:
    Type: String  
  az1:
    Type: String   
  instanceType:
    Type: String
    Default: t2.micro   
  ami:
    Type: String   
  CostCenter:
    Type: String
  ApplicationName:
    Type: String
  ProjectID:
    Type: String
  IONumber:
    Type: String
  Environment:
    Type: String
  ApplicationOwner:
    Type: String
  BusinessOwner:
    Type: String
  BusinessUnit:
    Type: String
  Hostname:
    Type: String
  Backup:
    Type: String
    Default: default
  Basesgwindows:
    Type: String
  AppID:
    Type: String
    Default: 1234
Resources:
  instance1:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ami
      InstanceType: !Ref instanceType
      SubnetId: !Ref subnetid1
      AvailabilityZone: !Ref az1
      SecurityGroupIds:
        - !Ref Basesgwindows
      Tags:
        - Key: "BusinessUnit"
          Value: !Ref BusinessUnit
        - Key: "CostCenter"
          Value: !Ref CostCenter
        - Key: "ApplicationName"
          Value: !Ref ApplicationName
        - Key: "ProjectID"
          Value: !Ref ProjectID
        - Key: "IONumber"
          Value: !Ref IONumber
        - Key: "Environment"
          Value: !Ref Environment  
        - Key: "ApplicationOwner"
          Value: !Ref ApplicationOwner
        - Key: "BusinessOwner"  
          Value: !Ref BusinessOwner
        - Key: "Hostname"
          Value: !Ref Hostname
        - Key: "Backup"
          Value: !Ref Backup
        - Key: "AppID"
          Value: !Ref AppID

user512452 user512452 · Accepted Answer · 2020-02-04T15:42:07

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFormation template to create Windows2016 VM
Parameters:
  vpcid:
    Type: String
  subnetid1:
    Type: String  
  az1:
    Type: String   
  instanceType:
    Type: String
    Default: t2.micro   
  ami:
    Type: String   
  CostCenter:
    Type: String
  ApplicationName:
    Type: String
  ProjectID:
    Type: String
  IONumber:
    Type: String
  Environment:
    Type: String
  ApplicationOwner:
    Type: String
  BusinessOwner:
    Type: String
  BusinessUnit:
    Type: String
  Hostname:
    Type: String
  Backup:
    Type: String
    Default: default
  Basesgwindows:
    Type: String
  AppID:
    Type: String
    Default: 1234
Resources:
  instance1:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ami
      InstanceType: !Ref instanceType
      SubnetId: !Ref subnetid1
      AvailabilityZone: !Ref az1
      SecurityGroupIds:
        - !Ref Basesgwindows
      Tags:
        - Key: "BusinessUnit"
          Value: !Ref BusinessUnit
        - Key: "CostCenter"
          Value: !Ref CostCenter
        - Key: "ApplicationName"
          Value: !Ref ApplicationName
        - Key: "ProjectID"
          Value: !Ref ProjectID
        - Key: "IONumber"
          Value: !Ref IONumber
        - Key: "Environment"
          Value: !Ref Environment  
        - Key: "ApplicationOwner"
          Value: !Ref ApplicationOwner
        - Key: "BusinessOwner"  
          Value: !Ref BusinessOwner
        - Key: "Hostname"
          Value: !Ref Hostname
        - Key: "Backup"
          Value: !Ref Backup
        - Key: "AppID"
          Value: !Ref AppID

SCP in Organization to restrict the creation of EC2 instance, volumes without mandatory tags

1 Answers