Enforce AWS Organizations tag policies

Overview

The AWS Organizations Tag Policies policy pack is a pre-built policy pack that integrates Pulumi with AWS Organizations. This integration validates your infrastructure as code against Tag Policies configured in AWS Organizations, blocking deployments when required tags are missing. For more information about enforcing tag policies with AWS Organizations Tag Policies, see the AWS documentation.

How it works

1. Configure tag policies in AWS Organizations: Define your required tags using tag policies, specifying which tags are mandatory for which resource types. The pack reads all tag requirements specified by the report_required_tag_for field in your tag policy configuration. See Prerequisites.
2. Enable the pack in Pulumi Cloud: Add the AWS Organizations Tag Policies pack to your Pulumi organization, and configure a policy group. The pack supports two enforcement levels: advisory mode (warns about missing tags without blocking deployments) and mandatory mode (blocks non-compliant deployments). Start in advisory mode so that violations appear on the Policy findings page without blocking deployments, then switch to mandatory mode once your Pulumi programs are compliant.
3. Validation during deployment: When you run pulumi up, the policy pack retrieves your tag policy requirements from AWS and validates that resources have the specified tags.

The pack uses AWS Organizations tag policies as the source of truth. Tag requirements are managed in AWS, not in Pulumi configuration.

Prerequisites

Before using this policy pack, complete the following setup in AWS:

Configure tag policies in AWS Organizations

Tag policies must be configured in your AWS Organization to define which tags are required for your resources. For detailed instructions, see the AWS Organizations Tag Policies documentation.

Grant required permissions

The AWS credentials used by your Pulumi stack must have permission to call the AWS Resource Groups Tagging API. Add the following IAM policy to the role or user running Pulumi deployments:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "resourcegroupstaggingapi:ListRequiredTags",
      "Resource": "*"
    }
  ]
}

The policy pack will use the same AWS credentials configured for your stack to fetch the required tags configuration.

Enabling the pack

The pack is available to your organization in Pulumi Cloud without any setup. To enforce it, add it to a policy group:

1. Navigate to Governance > Policy configuration and select the Policy Groups tab.
2. Create a policy group, or select an existing one that covers the stacks you want to check.
3. Select Select policy packs, choose AWS Organizations Tag Policies, and set its enforcement level.
4. Select Save Policy Group.

For more information about enabling policy packs, see Use pre-built policy packs.

Policy and supported resources

The pack contains one policy, aws-tag-policies-compliance-validation, and works with both the AWS (pulumi/aws) and AWS Native (pulumi/aws-native) providers. For the policy’s default enforcement level and severity, and for the full mapping of AWS tag policy resource types to Pulumi resource types, see the AWS Organizations Tag Policies pack reference.

Related documentation

• Policy as Code get started guide
• Pre-Built Policy Packs