title: EC2 IAM policy to require tags
body: <p>AWS just released required tag support for EC2/EBS:
  <a href="https://aws.amazon.com/blogs/aws/new-tag-ec2-instances-ebs-volumes-on-creation/" rel="nofollow noreferrer">New – Tag EC2 Instances &amp; EBS Volumes on Creation</a>.</p>
  
  <p>However, the example given only checks if tags have a fixed value which isn't useful to us because our users can enter free form values for required tags. How can a policy be written to check tags are present?</p>
  
  <p>For example, we need something like this:</p>
  
  <pre><code>"Statement": [
      {
        "Sid": "DenyMissingTags",
        "Effect": "Deny",
        "Action": "ec2:RunInstances",
        "Resource": "arn:aws:ec2:us-east-1:accountid:instance/*",
        "Condition": {
          "StringExists": [
            "aws:RequestTag/costcenter",
            "aws:RequestTag/stack",
           ]
         }
       }
  ]
  </code></pre>
  
  <p>Obviously, I made up <code>StringExists</code></p>