Enforcing EC2 Tagging at Launch with IAM Policy Conditions

Quick Answer

This works because IAM policy conditions can be evaluated against the specific values in a request, and aws:RequestTag/Creator checks the tag value the caller is attempting to apply, while the aws:username policy variable resolves dynamically to whichever IAM user is actually making the call. Combining them means the policy denies the RunInstances request unless the Creator tag exactly matches the calling user's own username, forcing correct, automatic attribution the moment the instance is created rather than relying on the user to type it in accurately. The reason this beats the alternatives is about timing: CloudTrail only records what happened after the fact, so it can tell you who launched an instance without a tag, but cannot stop that launch; AWS Config rules can detect untagged resources after they exist and even trigger remediation, but that is inherently reactive; and while an SCP can deny actions missing a required tag key, SCPs operate at the organization or account level, are not designed to validate that a tag's value matches a specific caller, and suit account-wide guardrails rather than per-user enforcement. Whenever a question asks for the most efficient way to enforce that a tag value matches something about the specific caller, look for an IAM policy condition referencing a dynamic variable like aws:username, since that enforces correctness at the moment of the request rather than after the fact.