You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -17,131 +17,49 @@ At Infraspec, we started noticing some major issues with how we were managing ou
17
17
18
18
As a result, our cloud costs were steadily increasing each month, and we had no clear way to track who was responsible for which resources. Without any tags, it was impossible to tie costs back to specific teams or projects, leaving us in the dark about where our budget was really going. This lack of accountability was causing both operational and financial headaches.
19
19
20
-
## The Solution: Enforcing a Tagging Policy
20
+
## Our Approach: Structuring AWS Accounts and Enforcing a Tagging Policy
21
21
22
22
Realizing that we needed a way to get things under control, we started exploring how AWS tags could help. By enforcing a tagging policy across all our AWS accounts, we could ensure that every resource was labeled with essential information like the owner, team, and environment.
23
23
24
24
But we didn’t stop there. To make sure everyone followed the rules, we implemented Service Control Policies (SCPs) that would block the creation of any resources that didn’t have the necessary tags. This added a layer of enforcement that gave us confidence that our tagging strategy would actually be used.
Tags are instrumental in achieving several goals within your AWS environment:
30
+
### Step 1: Organizing Accounts
29
31
30
-
-**Resource Identification**: Quickly locate and manage resources.
31
-
-**Cost Allocation**: Track spending and allocate costs to specific business units.
32
-
-**Security and Compliance**: Identify resources that need special security measures or compliance with regulations.
33
-
-**Automation**: Simplify management and automation tasks.
32
+
Our first step was to create an AWS Organizations structure that mirrored our operational needs. We separated our accounts into two main Organizational Units (OUs): `Infraspec OU` and `Core OU`. The `Infraspec OU` contains all the accounts related to our primary operations, including `Dev`, `Staging`, and `Prod`. The `Core OU` contains our `Core Account`, which handles shared services such as networking and also handles policy management instead of root account.
34
33
35
-
## Mandatory Tags: The Foundation of Your Tagging Strategy
34
+
This structure allowed us to clearly distinguish between different environments and core services, making it easier to enforce policies and manage resources.
36
35
37
-
Mandatory tags are essential for every AWS resource. They provide a baseline of information that is crucial for effective resource management and accountability. Here are some key mandatory tags and their purposes:
36
+
### Step 2: Implementing Tagging Policy
38
37
39
-
1.**Owner**
40
-
-**Purpose**: Identifies the owner or responsible team for the resource.
With our accounts organized, we moved on to enforce a tagging policy across all our AWS accounts. We established a set of mandatory tags that would be required for every resource, ensuring that all resources were labeled with essential information like the owner, team, and environment.
42
39
43
-
2.**Team**
44
-
-**Purpose**: Specifies the organizational team responsible for the resource.
To ensure compliance, we implemented Service Control Policies (SCPs) that blocked the creation of any resources without the necessary tags. This enforcement layer gave us the confidence that our tagging strategy would be consistently applied across all environments.
46
41
47
-
3.**Environment**
48
-
-**Purpose**: Indicates the environment type where the resource is deployed.
Discretionary tags are not required for every resource but are crucial for specific use cases. They provide additional layers of metadata that help manage resources more effectively.
74
-
75
-
1.**Version**
76
-
-**Purpose**: Specifies the version of the resource or application.
77
-
-**Sample Values**: `v1.0`, `v2.1`, `v3.2`
78
-
79
-
2.**Backup**
80
-
-**Purpose**: Indicates the backup frequency or requirement for the resource.
81
-
-**Sample Values**: `Daily`, `Weekly`, `Monthly`
82
-
83
-
3.**SLA**
84
-
-**Purpose**: Specifies the service-level agreement requirements for the resource.
85
-
-**Sample Values**: `99.9%`, `99.99%`
86
-
87
-
4.**Lifespan**
88
-
-**Purpose**: Indicates the expected lifespan or retention period for the resource.
-**Purpose**: Specifies the name or identifier of the AWS account associated with the resource.
109
-
-**Sample Values**: `Prod-Account`, `Dev-Account`
110
-
111
-
4.**SharedService**
112
-
-**Purpose**: Indicates if the resource is part of a shared service environment.
113
-
-**Sample Values**: `yes`, `no`
114
-
115
-
5.**RemoveAfterDate**
116
-
-**Purpose**: Specifies the date when the resource should be removed or decommissioned.
117
-
-**Sample Values**: `12/31/2024`
118
-
119
-
6.**Shutdown**
120
-
-**Purpose**: Indicates if the resource can be automatically shut down during non-business hours.
121
-
-**Sample Values**: `true`, `false`
122
-
123
-
124
-
## Enforcing Tagging Policies
125
-
126
-
To ensure compliance with your tagging strategy, establish detection and enforcement mechanisms:
127
-
128
-
1.**Automated Tagging**: Use Infrastructure as Code (IaC) tools to automate the tagging process during resource creation.
129
-
2.**Tag Policies**: Implement AWS Organizations Tag Policies to enforce tagging standards across accounts.
130
-
3.**Service Control Policies (SCPs)**: Use SCPs to prevent actions on resources without mandatory tags.
131
-
4.**Compliance Audits**: Regularly audit resources to ensure they comply with the tagging policies. Automate this process where possible.
132
-
133
-
## Implementing Tagging Policies in AWS
134
-
135
-
### 1. **Enforcing Tagging Standards with AWS Organizations Tag Policies**
136
-
137
-
AWS Organizations allows you to create tag policies that enforce your tagging standards across all accounts in your organization. Here’s how to create a tag policy:
138
-
139
-
-**Step 1**: Navigate to AWS Organizations and select “Tag policies” from the sidebar.
140
-
-**Step 2**: Click “Create policy” and define your tag rules. For example, you can enforce that all resources must have the `ManagedBy` tag.
42
+
We defined the following tags as mandatory across our AWS environment and implemented them using AWS Organizations Tag Policies. Below is an example of how these tags were structured and enforced:
141
43
142
44
```json
143
45
{
144
46
"tags": {
47
+
"Owner": {
48
+
"tag_key": {
49
+
"@@assign": "Owner"
50
+
},
51
+
"enforced_for": {
52
+
"@@assign": [
53
+
"ec2:instance",
54
+
"ec2:vpc",
55
+
"ec2:subnet",
56
+
"ec2:natgateway",
57
+
"ec2:security-group",
58
+
"ec2:route-table",
59
+
"ec2:internet-gateway"
60
+
]
61
+
}
62
+
},
145
63
"ManagedBy": {
146
64
"tag_key": {
147
65
"@@assign": "ManagedBy"
@@ -156,39 +74,70 @@ AWS Organizations allows you to create tag policies that enforce your tagging st
156
74
"@@assign": [
157
75
"ec2:instance",
158
76
"ec2:vpc",
77
+
"ec2:subnet",
159
78
"ec2:natgateway",
79
+
"ec2:security-group",
160
80
"ec2:route-table",
161
81
"ec2:internet-gateway"
162
82
]
163
83
}
164
-
},
84
+
}
165
85
}
166
86
}
167
87
```
168
88
169
-
-**Step 3**: Attach the policy to your organizational units (OUs) or accounts to enforce compliance.
170
-
171
-
### 2. **Using Service Control Policies (SCPs) to Block Non-Compliant Resources**
89
+
### Step 2: Implementing Service Control Policy
172
90
173
-
You can create SCPs in AWS Organizations to prevent the creation of resources without mandatory tags. Here’s an example policy:
91
+
We created SCPs in AWS Organizations to prevent the creation of resources without mandatory tags. For example, the following SCP blocks the creation of EC2 instances and other resources if the `Owner` and `ManagedBy` tag is missing:
174
92
175
93
```json
176
94
{
177
95
"Version": "2012-10-17",
178
96
"Statement": [
97
+
{
98
+
"Sid": "DenyEC2CreationWithNoOwnerTag",
99
+
"Effect": "Deny",
100
+
"Action": [
101
+
"ec2:RunInstances",
102
+
"ec2:CreateVpc",
103
+
"ec2:CreateSubnet",
104
+
"ec2:CreateNatGateway",
105
+
"ec2:CreateSecurityGroup",
106
+
"ec2:CreateRouteTable",
107
+
"ec2:CreateInternetGateway"
108
+
],
109
+
"Resource": [
110
+
"arn:aws:ec2:*:*:vpc/*",
111
+
"arn:aws:ec2:*:*:subnet/*",
112
+
"arn:aws:ec2:*:*:natgateway/*",
113
+
"arn:aws:ec2:*:*:security-group/*",
114
+
"arn:aws:ec2:*:*:route-table/*",
115
+
"arn:aws:ec2:*:*:internet-gateway/*",
116
+
"arn:aws:ec2:*:*:instance/*"
117
+
],
118
+
"Condition": {
119
+
"Null": {
120
+
"aws:RequestTag/Owner": "true"
121
+
}
122
+
}
123
+
},
179
124
{
180
125
"Sid": "DenyEC2CreationWithNoManagedByTag",
181
126
"Effect": "Deny",
182
127
"Action": [
183
128
"ec2:RunInstances",
184
129
"ec2:CreateVpc",
130
+
"ec2:CreateSubnet",
185
131
"ec2:CreateNatGateway",
132
+
"ec2:CreateSecurityGroup",
186
133
"ec2:CreateRouteTable",
187
134
"ec2:CreateInternetGateway"
188
135
],
189
136
"Resource": [
190
137
"arn:aws:ec2:*:*:vpc/*",
138
+
"arn:aws:ec2:*:*:subnet/*",
191
139
"arn:aws:ec2:*:*:natgateway/*",
140
+
"arn:aws:ec2:*:*:security-group/*",
192
141
"arn:aws:ec2:*:*:route-table/*",
193
142
"arn:aws:ec2:*:*:internet-gateway/*",
194
143
"arn:aws:ec2:*:*:instance/*"
@@ -202,6 +151,25 @@ You can create SCPs in AWS Organizations to prevent the creation of resources wi
202
151
]
203
152
}
204
153
```
154
+
155
+
## Testing the Policy
156
+
157
+
After implementing the tagging and scp policies, we conducted rigorous testing to ensure compliance across our EC2 resources. We deployed several EC2 instances with and without the mandatory tags to verify the enforcement mechanisms.
158
+
159
+
-**Success Case**: When an EC2 instance was launched with all mandatory tags (`Owner`, `ManagedBy`), the instance creation proceeded without any issues.
160
+
161
+
-**Failure Case**: When an attempt was made to launch an EC2 instance without the `ManagedBy` tag, the operation was denied, demonstrating the effectiveness of our SCP in enforcing tag compliance.
162
+
163
+
## The Impact of Tags in Our Organization
164
+
165
+
### Resource Identification and Ownership
166
+
167
+
-**Owner Tag**: By tagging each resource with an `Owner`, we could quickly identify who was responsible for any given resource. This became critical when tracking down resources that were running unexpectedly or were no longer needed. The `Owner` tag provided clear accountability, making it easier to manage and decommission resources no longer in use.
168
+
169
+
### Operational Efficiency and Automation
170
+
171
+
-**ManagedBy Tag**: The `ManagedBy` tag helped us distinguish between resources managed by Terraform and those managed manually. This was particularly useful for automating resource management and ensuring that Terraform-managed resources were consistent with our infrastructure-as-code policies.
172
+
205
173
## Tag Naming and Usage Conventions
206
174
207
175
To ensure consistency and avoid conflicts, adhere to the following conventions:
@@ -220,10 +188,6 @@ To ensure consistency and avoid conflicts, adhere to the following conventions:
220
188
3.**Documentation**: Maintain comprehensive documentation of your tagging strategy and dictionary for reference.
221
189
4.**Stakeholder Involvement**: Involve all relevant stakeholders in defining and reviewing the tagging strategy to ensure it meets organizational needs.
222
190
223
-
## The Impact: Accountability and Cost Control
224
-
225
-
Implementing this tagging strategy was a game-changer for us. We now had clear visibility into who was using what resources, and we could track our cloud costs with precision. This made it much easier to allocate expenses to the correct departments and projects, and we finally had the accountability we needed.
226
-
227
191
## Conclusion
228
192
229
193
A well-defined tagging strategy is essential for effective cloud resource management. By distinguishing between mandatory and discretionary tags and implementing robust enforcement mechanisms, you can achieve better visibility, cost control, and security in your AWS environment. Start by establishing a clear tagging dictionary and ensure compliance through automation and regular audits.
0 commit comments