Why we need be responsable with our AWS bills😅

We know how to use AWS, but when you recibe bills for unused services, it is pain. These days, you can find many aplication inside AWS that help you with your cost expenses. In the past, I saw many features for AWS plans like organization, but these days you have the same one in your account. We can have the same bill as organizations if we don’t use the tools for tracking cost.

I want to try the AWS Tag Policies section, but i am not in an Organization

That feature is for Organizations, and Organizations are meant for big infrastructures.This is a good blog post 👉 How to set up tag policies in Organizations. You don’t need to wait just try other methods.

Now I will present the aws:RequestTag that you can apply inside any policy condition for Deny SQS creation or other resource. First, add a policy to an IAM group(in my case devs group) that grants permission to all users within that group.

A normal denny Policy.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyCreateQueueWithoutEnvTag",
      "Effect": "Deny",
      "Action": "sqs:CreateQueue",
      "Resource": "arn:aws:<some-resource>:::<name>",
      #################### CONDITION
    }
  ]
}

The condition could be.

• Not Env in tags.

1
2
3
4
5

 "Condition": {
        "Null": {
          "aws:RequestTag/Env": "true"
        }
      }

or

• The tag value not equal to: dev, test or prod.

1
2
3
4
5
6
7
8

"Condition": {
  "StringNotEquals": {
    "aws:RequestTag/Env": [
      "dev",
      "test",
      "prod"
    ]
  }

Off topic

You can change the wordl!!