Evaluating compliance for an account - Tagging AWS Resources and Tag Editor

Evaluating compliance for an account

You can evaluate the compliance of an account in your organization with its effective tag policy.

Important

Untagged resources don't appear as noncompliant in results.

To find untagged resources in your account, use AWS Resource Explorer with a query that uses tag:none. For more information, see Search for untagged resources in the AWS Resource Explorer User Guide.

The effective tag policy specifies the tagging rules that apply to an account. The effective tag policy is the aggregation of any tag policies that the account inherits, plus any tag policy directly attached to the account. When you attach a tag policy to the organization root, it applies to all accounts in your organization. When you attach a tag policy to an organizational unit (OU), it applies to all accounts and OUs that belong to the OU.

Note

If you haven't yet created tag policies, see Getting started with tag policies in the AWS Organizations User Guide.

To find noncompliant tags, you must have the following permissions:

  • organizations:DescribeEffectivePolicy

  • tag:GetResources

  • tag:TagResources

  • tag:UntagResources

To evaluate an account's compliance with its effective tag policy (console)

  1. While signed in to the account whose compliance you want to check, open the Tag Policies console.

  2. The Effective tag policy section shows when the policy was last updated and the defined tag keys. You can expand a tag key to see information about its values, case treatment, and whether the values are enforced for specific resources types.

    Note

    If you're signed in to the management account, you need to choose an account to see its effective policy and view compliance information.

  3. In the Resources with noncompliant tags section, specify which AWS Region to search for noncompliant tags. Optionally, you can also search by resource type. Then choose Search resources.

    Real-time results are shown in the Search results section. To change the number of results returned per page or the columns to display, choose the settings icon.

  4. In the search results, select a resource with noncompliant tags.

  5. In the dialog box that lists the resource's tags, choose the hyperlink to open the AWS service where the resource was created. From that console, correct the noncompliant tag.

    Tip

    If you're not sure which tags are noncompliant, go to the Effective tag policy section for the account in the Tag Policies console. You can expand a tag key to view its tagging rules.

  6. Repeat the process of finding and correcting tags until the account resources that you care about are compliant in each Region.

To find noncompliant tags (AWS CLI, AWS API)

Use the following commands and operations to find noncompliant tags:

Next steps

We recommend that you repeat the process of finding and correcting compliance issues. Continue until the account's resources that you care about are compliant with the effective tag policy in each Region.

Finding and correcting noncompliant tags is an iterative process for multiple reasons, including the following:

  • Your organization's use of tag policies can evolve over time.

  • It takes time to effect change in your organization when creating resources.

  • Compliance can change anytime that a new resource is created or when new tags are assigned to a resource.

  • An account's effective tag policy is updated whenever a tag policy is attached to or detached from it. The effective tag policy is also updated whenever changes occur to tag the policies that the account inherits.

If you're signed in as the management account in the organization, you can also generate a report. This report shows information about all tagged resources in your organization's accounts. For more information, see Evaluating organization-wide compliance.