---
title: Enforce AWS Organizations tag policies
url: /docs/discovery-governance/guides/aws-organizations-tag-policies/
---
> This [Pulumi Cloud](/docs/iac/concepts/pulumi-cloud/) feature is available in the [Essentials, Pro, and Enterprise editions](/pricing/#pre-built-policy-packs).



## Overview

The [AWS Organizations Tag Policies policy pack](/docs/reference/pre-built-policy-packs/aws-organizations-tag-policies/aws/) is a pre-built policy pack that integrates Pulumi with AWS Organizations. This integration validates your infrastructure as code against Tag Policies configured in AWS Organizations, blocking deployments when required tags are missing. For more information about enforcing tag policies with AWS Organizations Tag Policies, see the [AWS documentation](https://docs.aws.amazon.com/organizations/latest/userguide/enforce-required-tag-keys-iac.html).

## How it works

1. **Configure tag policies in AWS Organizations**: Define your required tags using tag policies, specifying which tags are mandatory for which resource types. The pack reads all tag requirements specified by the `report_required_tag_for` field in your tag policy configuration. See [Prerequisites](#prerequisites).
1. **Enable the pack in Pulumi Cloud**: Add the AWS Organizations Tag Policies pack to your Pulumi organization, and configure a policy group. The pack supports two enforcement levels: advisory mode (warns about missing tags without blocking deployments) and mandatory mode (blocks non-compliant deployments). Start in advisory mode so that violations appear on the [Policy findings](/docs/discovery-governance/operations/policy-findings/) page without blocking deployments, then switch to mandatory mode once your Pulumi programs are compliant.
1. **Validation during deployment**: When you run `pulumi up`, the policy pack retrieves your tag policy requirements from AWS and validates that resources have the specified tags.

The pack uses AWS Organizations tag policies as the source of truth. Tag requirements are managed in AWS, not in Pulumi configuration.

## Prerequisites

Before using this policy pack, complete the following setup in AWS:

### Configure tag policies in AWS Organizations

Tag policies must be configured in your AWS Organization to define which tags are required for your resources. For detailed instructions, see the [AWS Organizations Tag Policies documentation](https://docs.aws.amazon.com/organizations/latest/userguide/enforce-required-tag-keys-iac.html).

### Grant required permissions

The AWS credentials used by your Pulumi stack must have permission to call the AWS Resource Groups Tagging API. Add the following IAM policy to the role or user running Pulumi deployments:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "resourcegroupstaggingapi:ListRequiredTags",
      "Resource": "*"
    }
  ]
}
```

The policy pack will use the same AWS credentials configured for your stack to fetch the required tags configuration.

## Enabling the pack

The pack is available to your organization in Pulumi Cloud without any setup. To enforce it, add it to a policy group:

1. Navigate to **Governance** > **Policy configuration** and select the **Policy Groups** tab.
1. Create a policy group, or select an existing one that covers the stacks you want to check.
1. Select **Select policy packs**, choose **AWS Organizations Tag Policies**, and set its enforcement level.
1. Select **Save Policy Group**.

For more information about enabling policy packs, see [Use pre-built policy packs](/docs/discovery-governance/guides/pre-built-policy-packs/).

## Policy and supported resources

The pack contains one policy, `aws-tag-policies-compliance-validation`, and works with both the AWS (`pulumi/aws`) and AWS Native (`pulumi/aws-native`) providers. For the policy's default enforcement level and severity, and for the full mapping of AWS tag policy resource types to Pulumi resource types, see the [AWS Organizations Tag Policies pack reference](/docs/reference/pre-built-policy-packs/aws-organizations-tag-policies/aws/).

## Related documentation

- [Policy as Code get started guide](/docs/discovery-governance/get-started/enforce-policy-as-code/)
- [Pre-Built Policy Packs](/docs/discovery-governance/guides/pre-built-policy-packs/)