awslabs / awslabs/aws-deployment-framework

Allow multiple tagging-policy.json per OU in adf-bootstrap

Open
#278 1 comment 1 reaction 1 assignee Claimed by @sbkok View on GitHub
Dominant language
Python
Stars
699
Forks
235
Avg merge
20h 53m
Merged PRs (30d)
7

Description

I have two tags which I want to enforce to all the resources in my OUs: `CostCenter` and `Environment`.
ADF only recognises the file called `tagging-policy.json` in the `adf-bootstrap` folder.

Creating a single `tagging-policy.json` to enforce these two tags will fail because it exceeds the maximum policy size
```
botocore.errorfactory.ConstraintViolationException: An error occurred (ConstraintViolationException) when calling the CreatePolicy operation: You have exceeded the maximum policy size.
```
The policy looks like:

```{
"tags": {
"Environment": {
"tag_key": {
"@@assign": "Environment"
},
"tag_value": {
"@@assign": [
"production",
"staging",
"sandbox"
]
},
"enforced_for": {
"@@assign": [
"apigateway:apikeys",
"apigateway:domainnames",
"apigateway:restapis",
"apigateway:stages",
"athena:*",
"acm:*",
"cloudfront:*",
"cloudtrail:*",
"cloudwatch:*",
"events:*",
"cognito-identity:*",
"cognito-idp:*",
"dynamodb:*",
"ec2:client-vpn-endpoint",
"ec2:customer-gateway",
"ec2:dhcp-options",
"ec2:elastic-ip",
"ec2:fleet",
"ec2:image",
"ec2:instance",
"ec2:internet-gateway",
"ec2:launch-template",
"ec2:natgateway",
"ec2:network-acl",
"ec2:network-interface",
"ec2:reserved-instances",
"ec2:route-table",
"ec2:security-group",
"ec2:snapshot",
"ec2:spot-instance-request",
"ec2:subnet",
"ec2:volume",
"ec2:vpc",
"ec2:vpc-endpoint",
"ec2:vpc-endpoint-service",
"ec2:vpn-connection",
"ec2:vpn-gateway",
"elasticfilesystem:*",
"ecs:task-set",
"ecs:cluster",
"ecs:service",
"elasticache:cluster",
"elasticloadbalancing:*",
"iotanalytics:*",
"iotevents:*",
"kinesisanalytics:*",
"kms:*",
"lambda:*",
"rds:cluster-pg",
"rds:es",
"rds:og",
"rds:pg",
"rds:ri",
"rds:secgrp",
"rds:subgrp",
"redshift:*",
"ram:*",
"resource-groups:*",
"route53:hostedzone",
"s3:bucket",
"secretsmanager:*",
"sqs:queue",
"storagegateway:*"
]
}
}
},
"CostCenter": {
"tag_key": {
"@@assign": "CostCenter"
},
"enforced_for": {
"@@assign": [
"apigateway:apikeys",
"apigateway:domainnames",
"apigateway:restapis",
"apigateway:stages",
"athena:*",
"acm:*",
"cloudfront:*",
"cloudtrail:*",
"cloudwatch:*",
"events:*",
"cognito-identity:*",
"cognito-idp:*",
"dynamodb:*",
"ec2:client-vpn-endpoint",
"ec2:customer-gateway",
"ec2:dhcp-options",
"ec2:elastic-ip",
"ec2:fleet",
"ec2:image",
"ec2:instance",
"ec2:internet-gateway",
"ec2:launch-template",
"ec2:natgateway",
"ec2:network-acl",
"ec2:network-interface",
"ec2:reserved-instances",
"ec2:route-table",
"ec2:security-group",
"ec2:snapshot",
"ec2:spot-instance-request",
"ec2:subnet",
"ec2:volume",
"ec2:vpc",
"ec2:vpc-endpoint",
"ec2:vpc-endpoint-service",
"ec2:vpn-connection",
"ec2:vpn-gateway",
"elasticfilesystem:*",
"ecs:task-set",
"ecs:cluster",
"ecs:service",
"elasticache:cluster",
"elasticloadbalancing:*",
"iotanalytics:*",
"iotevents:*",
"kinesisanalytics:*",
"kms:*",
"lambda:*",
"rds:cluster-pg",
"rds:es",
"rds:og",
"rds:pg",
"rds:ri",
"rds:secgrp",
"rds:subgrp",
"redshift:*",
"ram:*",
"resource-groups:*",
"route53:hostedzone",
"s3:bucket",
"secretsmanager:*",
"sqs:queue",
"storagegateway:*"
]
}
}
}
}```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.