Check ID: organizations_tags_policies_enabled_and_attached
Provider: AWS
Service: organizations
Severity: LOW
Resource type: Other

​
What this check verifies

AWS Organizations tag policies are evaluated for their presence and attachment to organization targets (accounts or OUs), distinguishing between no policies, policies defined but not attached, and policies attached to at least one target.

​
Risk

Absent or unattached tag policies cause inconsistent or missing tags, undermining:
  • Confidentiality via bypassed tag-based access conditions
  • Integrity through misclassified resources and drift
  • Availability when automation, cost routing, or incident scoping that rely on tags break

​
Recommendation

Enable tag policies and attach them to relevant roots/OUs/accounts. Define mandatory keys (e.g., Environment, CostCenter) with allowed values. Apply defense in depth by using tags in IAM conditions and SCPs. Start with validation-only, then enforce, and continuously monitor compliance across accounts.

​
Remediation

# Create a Tag Policy
resource "aws_organizations_policy" "<example_resource_name>" {
  name    = "<example_resource_name>"
  type    = "TAG_POLICY"  # Critical: defines a Tag Policy type
  content = jsonencode({
    tags = {
      Environment = {
        tag_key = { "@@assign" = "Environment" }
      }
    }
  })
}

# Attach the Tag Policy to a target (Root/OU/Account)
resource "aws_organizations_policy_attachment" "<example_resource_name>" {
  policy_id = aws_organizations_policy.<example_resource_name>.id
  target_id = "<example_resource_id>"  # Critical: attaches the policy to an account/OU/root
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = organizations_tags_policies_enabled_and_attached. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks