> For the complete documentation index, see [llms.txt](https://docs.onelens.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onelens.cloud/automate/automated-tagging/aws-iam-permissions.md).

# AWS IAM Permissions

#### 1. ResourceGroupsTaggingAPI Permissions

These permissions are required for the tagging tool to **discover and apply tags** across your AWS resources centrally. The `ResourceGroupsTaggingAPI` is the AWS-recommended way to tag resources across multiple services in a single API call, without needing service-specific tagging calls for each resource type.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ResourceGroupsTaggingPermissions",
            "Effect": "Allow",
            "Action": [
                "tag:GetResources",
                "tag:TagResources",
                "tag:UntagResources",
                "tag:GetTagKeys",
                "tag:GetTagValues"
            ],
            "Resource": "*"
        }
    ]
}
```

| Action                                | Purpose                                                      |
| ------------------------------------- | ------------------------------------------------------------ |
| `tag:GetResources`                    | List and discover resources across your account              |
| `tag:TagResources`                    | Apply tags to resources in bulk                              |
| `tag:UntagResources`                  | Remove tags when needed                                      |
| `tag:GetTagKeys` / `tag:GetTagValues` | Read existing tags to avoid duplicates and validate coverage |

***

#### 2. Service-Specific Tagging Permissions

Even though the `ResourceGroupsTaggingAPI` orchestrates tagging centrally, AWS requires that the IAM role also has **direct tagging permissions on each service** — this is an AWS enforcement mechanism. Without these, `tag:TagResources` calls will silently fail for that service.

The exact list depends on which AWS services you use. Below are a few examples:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2TaggingPermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags",
                "ec2:DeleteTags"
            ],
            "Resource": "*"
        },
        {
            "Sid": "S3TaggingPermissions",
            "Effect": "Allow",
            "Action": [
                "s3:PutBucketTagging",
                "s3:GetBucketTagging"
            ],
            "Resource": "*"
        },
        {
            "Sid": "LambdaTaggingPermissions",
            "Effect": "Allow",
            "Action": [
                "lambda:TagResource",
                "lambda:UntagResource"
            ],
            "Resource": "*"
        }
    ]
}
```

> **Note:** This list will be customized based on the specific AWS services in your account. For example, if you use RDS, ElastiCache, DynamoDB, or CloudFront, the corresponding service-level tagging actions will be added. Share your list of AWS services in use and we'll provide the exact policy tailored to your environment.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.onelens.cloud/automate/automated-tagging/aws-iam-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.