AWS Organizations Tag Policies

Overview

The AWS Organizations Tag Policies policy pack is a pre-built policy pack that integrates Pulumi with AWS Organizations. This integration validates your infrastructure as code against Tag Policies configured in AWS Organizations, blocking deployments when required tags are missing. For more information about enforcing tag policies with AWS Organizations Tag Policies, see the AWS documentation.

How it works

1. Configure tag policies in AWS Organizations: Define your required tags using tag policies, specifying which tags are mandatory for which resource types. The pack reads all tag requirements specified by the report_required_tag_for field in your tag policy configuration.
2. Enable the pack in Pulumi Cloud: Add the AWS Organizations Tag Policies pack to your Pulumi organization, and configure a policy group. The pack supports two enforcement levels: advisory mode (warns about missing tags without blocking deployments) and mandatory mode (blocks non-compliant deployments).
3. Validation during deployment: When you run pulumi up, the policy pack retrieves your tag policy requirements from AWS and validates that resources have the specified tags.
4. Enforcement levels: Start in advisory mode to surface violations without blocking deployments. All policy violations are displayed in the Pulumi Cloud Policy Findings page for monitoring and tracking, enabling a controlled migration to compliance. Once your Pulumi programs are compliant, switch to mandatory mode to block any future non-compliant deployments.

The pack uses AWS Organizations tag policies as the source of truth. Tag requirements are managed in AWS, not in Pulumi configuration.

Prerequisites

Before using this policy pack, complete the following setup in AWS:

Configure tag policies in AWS Organizations

Tag policies must be configured in your AWS Organization to define which tags are required for your resources. For detailed instructions, see the AWS Organizations Tag Policies documentation.

Grant required permissions

The AWS credentials used by your Pulumi stack must have permission to call the AWS Resource Groups Tagging API. Add the following IAM policy to the role or user running Pulumi deployments:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "resourcegroupstaggingapi:ListRequiredTags",
      "Resource": "*"
    }
  ]
}

The policy pack will use the same AWS credentials configured for your stack to fetch the required tags configuration.

Enabling the pack

To enable this policy pack for your organization:

1. From within your organization, navigate to the Policies tab
2. Under Policy Packs, select the Available tab
3. Select AWS Organizations Tag Policies and select Add to organization
4. From the Organizations tab, apply the policy to a Policy Group to enforce tag validation

For more information about enabling policy packs, see Pre-Built Packs.

Policy reference

This pack includes a single resource policy:

Supported resources

The pack works with both the AWS (pulumi/aws) and AWS Native (pulumi/aws-native) Pulumi providers.

AWS Native Provider types

The AWS Native Provider (pulumi/aws-native) is based on AWS Cloud Control, and hence is natively supported by the AWS Organizations Tag Policies report_required_tag_for setting. For a complete list of supported resource types, see Supported resources for tag policies enforcement in the AWS documentation.

AWS Provider types

The AWS Provider (pulumi/aws) uses different resource type naming conventions than AWS Cloud Control. The pack automatically maps AWS tag policy resource types (specified in report_required_tag_for) to their corresponding Pulumi AWS resource types. The following table shows the supported mappings:

Related documentation

• Policy as Code get started guide
• Pre-Built Policy Packs