[アップデート]CloudFormation、Terraform、PulumiでAWS Organizationsのタグポリシーに適合しているか事前チェックできるようになりました

# リソース作成成功
$ aws sqs create-queue --queue-name my-queue --tags Env=Test
{
    "QueueUrl": "https://sqs.us-east-1.amazonaws.com/12345678901/my-queue"
}
# タグキーEnvにTestかProd以外の値を設定するとエラーが出て作成できない
$ aws sqs create-queue --queue-name my-queue --tags Env=hoge

An error occurred (InvalidParameterValue) when calling the CreateQueue operation: The tag policy does not allow the specified value for the following tag key: 'Env'.
~ $

# SQSキューにタグを設定しなくても作成は可能
$ aws sqs create-queue --queue-name my-queue
{
    "QueueUrl": "https://sqs.us-east-1.amazonaws.com/12345678901/my-queue"
}

data "aws_caller_identity" "current" {}

resource "aws_organizations_policy" "example" {
  name    = "tag-policy-example"
  content = <<EOF
{
  "tags": {
    "Owner": {
      "tag_key": {
        "@@assign": "Owner"
      },
      "report_required_tag_for": {
        "@@assign": [
          "logs:log-group"
        ]
      }
    }
  }
}
EOF
  type    = "TAG_POLICY"
}

resource "aws_organizations_policy_attachment" "example" {
  policy_id = aws_organizations_policy.example.id
  target_id = data.aws_caller_identity.current.account_id
}

provider "aws" {
  tag_policy_compliance = "error"
}

resource "aws_cloudwatch_log_group" "example" {
  name = "required-tags-demo"
}

terraform plan

Planning failed. Terraform encountered an error while generating this plan.

╷
│ Error: Missing Required Tags - An organizational tag policy requires the following tags for aws_cloudwatch_log_group: [Owner]
│
│   with aws_cloudwatch_log_group.example,
│   on main.tf line 33, in resource "aws_cloudwatch_log_group" "example":
│   33: resource "aws_cloudwatch_log_group" "example" {
│

resource "aws_cloudwatch_log_group" "example" {
  name = "required-tags-demo"
+  tags = {
+    Owner = "foo"
+  }
}

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_cloudwatch_log_group.example will be created
  + resource "aws_cloudwatch_log_group" "example" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "required-tags-demo"
      + name_prefix       = (known after apply)
      + region            = "ap-northeast-1"
      + retention_in_days = 0
      + skip_destroy      = false
      + tags              = {
          + "Owner" = "foo"
        }
      + tags_all          = {
          + "Owner" = "foo"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't guarantee to take exactly these actions if you run "terraform apply" now.