AWS IAM Permissions

AWS IAM Permissions Required for Tagging Automation

1. ResourceGroupsTaggingAPI Permissions

These permissions are required for the tagging tool to discover and apply tags across your AWS resources centrally. The ResourceGroupsTaggingAPI is the AWS-recommended way to tag resources across multiple services in a single API call, without needing service-specific tagging calls for each resource type.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ResourceGroupsTaggingPermissions",
            "Effect": "Allow",
            "Action": [
                "tag:GetResources",
                "tag:TagResources",
                "tag:UntagResources",
                "tag:GetTagKeys",
                "tag:GetTagValues"
            ],
            "Resource": "*"
        }
    ]
}

Action	Purpose
tag:GetResources	List and discover resources across your account
tag:TagResources	Apply tags to resources in bulk
tag:UntagResources	Remove tags when needed
tag:GetTagKeys / tag:GetTagValues	Read existing tags to avoid duplicates and validate coverage

---

2. Service-Specific Tagging Permissions

Even though the ResourceGroupsTaggingAPI orchestrates tagging centrally, AWS requires that the IAM role also has direct tagging permissions on each service — this is an AWS enforcement mechanism. Without these, tag:TagResources calls will silently fail for that service.

The exact list depends on which AWS services you use. Below are a few examples:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2TaggingPermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags",
                "ec2:DeleteTags"
            ],
            "Resource": "*"
        },
        {
            "Sid": "S3TaggingPermissions",
            "Effect": "Allow",
            "Action": [
                "s3:PutBucketTagging",
                "s3:GetBucketTagging"
            ],
            "Resource": "*"
        },
        {
            "Sid": "LambdaTaggingPermissions",
            "Effect": "Allow",
            "Action": [
                "lambda:TagResource",
                "lambda:UntagResource"
            ],
            "Resource": "*"
        }
    ]
}

Note: This list will be customized based on the specific AWS services in your account. For example, if you use RDS, ElastiCache, DynamoDB, or CloudFront, the corresponding service-level tagging actions will be added. Share your list of AWS services in use and we'll provide the exact policy tailored to your environment.