Tagging your AWS IoT Wireless resources

To help you manage and organize your devices, gateways, destinations, and profiles, you can optionally assign your own metadata to each of these resources in the form of tags. This section describes tags and shows you how to create them. AWS IoT Wireless doesn't have billing groups, and uses the same billing groups as AWS IoT Core. For more information, see Billing groups in the AWS IoT Core documentation.

Tag basics

When you've several AWS IoT Wireless resources of the same type, you can use tags to categorize your resources in different ways (for example, by purpose, owner, or environment). This helps you quickly identify a resource based on the tags you've assigned to it.

Each tag consists of a key and optional value, both of which you define. For example, you can define a set of tags for a group of LoRaWAN devices for which the device firmware is being updated. To more easily manage your resources, we recommend that you create a consistent set of tag keys that meets your needs for each kind of resource.

You can search for and filter resources based on the tags you add or apply. You can also use tags to control access to your resources by using IAM policies and billing group tags to categorize and track your costs.

Create and manage tags

You can create and manage tags using the Tag Editor in the AWS Management Console, the AWS IoT Wireless, or the AWS CLI

Using the console

For ease of use, the Tag Editor in the AWS Management Console provides a central, unified way to create and manage your tags. For more information, see Working with Tag Editor in Working with the AWS Management Console.

Using the API or CLI

You can also use the API or CLI, and associate tags with wireless devices, gateways, profiles, and destinations when you create then by using the Tags field in the following commands:

Update tags or list tags for resources

You can add, modify, or delete tags for existing resources that support tagging by using the following commands:

You can edit tag keys and values, and you can remove tags from a resource at any time. You can set the value of a tag to an empty string, but you can't set the value of a tag to null. If you add a tag that has the same key as an existing tag on that resource, the new value overwrites the old value. If you delete a resource, any tags associated with the resource are also deleted.

Tag restrictions and limitations

The following basic restrictions apply to tags:

Using tags with IAM policies

To specify what resources a user can create, modify, or use, you can apply tag-based resource-level permissions in the IAM policies you use for AWS IoT Wireless API actions. To control user access (permissions) based on a resource's tags, use the Condition element (also called the Condition block) with the following condition context keys and values in an IAM policy.

For more information about using tags, see Controlling Access Using Tags in the AWS Identity and Access Management User Guide. The IAM JSON Policy Reference section of that guide has detailed syntax, descriptions, and examples of the elements, variables, and evaluation logic of JSON policies in IAM.

The following example policy applies two tag-based restrictions. An IAM user restricted by this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "iot:CreateMulticastGroup",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/env": "prod"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": [
        "iot:CreateMulticastGroup",
        "iot:UpdateMulticastGroup",
        "iot:GetMulticastGroup",
        "iot:ListMulticastGroups"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/env": "prod"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:CreateMulticastGroup",
        "iot:UpdateMulticastGroup",
        "iot:GetMulticastGroup",
        "iot:ListMulticastGroups"
      ],
      "Resource": "*"
    }
  ]
}

You can also specify multiple tag values for a given tag key by enclosing them in a list, like this:

"StringEquals" : {
              "aws:ResourceTag/env" : ["dev", "test"]
}